Microsoft Entra Privileged Identity Management: 2026 Guide

Microsoft Entra Privileged Identity Management (PIM) is the Microsoft Entra ID service that removes standing admin rights and replaces them with time-limited, audited access. A stolen admin account is one of the fastest routes to a full tenant compromise. PIM shrinks the window in which that account is useful to an attacker.

This guide explains what PIM does and which license you need. It covers eligible and active assignments, approval and MFA rules, and access reviews. You also get a step-by-step Global Administrator setup and a PIM vs PAM comparison. We close with the best practices we apply in client tenants across the UAE, Saudi Arabia and the USA.

What is Microsoft Entra Privileged Identity Management?

Microsoft Entra Privileged Identity Management is a Microsoft Entra ID Governance feature that gives admins just-in-time access to privileged roles. Users are made eligible for a role, then activate it for a set number of hours. Activation can require MFA, a business justification, a ticket number and approval. Every activation is logged.

PIM covers three kinds of access:

• Microsoft Entra roles, such as Global Administrator, Exchange Administrator and Security Administrator.
• Azure resource roles, such as Owner or Contributor on a management group, subscription or resource group.
• PIM for Groups, which gives just-in-time membership or ownership of a security group. Use it to cover apps and roles that are granted through group membership.

Key takeaways

• PIM needs a Microsoft Entra ID P2 or Microsoft Entra ID Governance license for the users who benefit from it.
• Eligible assignments mean no standing access. Users activate the role only when they need it.
• Activation can last between 1 and 24 hours. Shorter is safer.
• Require MFA, justification and, for top roles, approval from at least two named approvers.
• Keep two emergency access accounts with permanent active Global Administrator rights outside normal PIM flows.
• Run quarterly access reviews on privileged roles so eligibility does not pile up.

What license do you need for Entra PIM?

Microsoft Learn states that PIM requires a Microsoft Entra ID P2 or Microsoft Entra ID Governance license. Licensing follows the user who benefits. That includes every admin who is eligible or active in a PIM-managed role, every approver, and every reviewer in an access review.

Microsoft 365 E5 includes Entra ID P2. Microsoft 365 E3 and Business Premium include Entra ID P1 only, which does not cover PIM. If most staff are on E3, you can buy P2 or ID Governance just for the admin group instead of upgrading everyone.

Prices are list prices in USD, as of November 2026. Check with your Microsoft partner for UAE, KSA and agreement pricing. For a wider plan comparison, read Entra ID P1 vs P2 and which one you actually need.

Eligible vs active assignments: what is the difference?

This is the core concept in PIM. Get it right and the rest follows.

• Eligible assignment: the user holds no rights until they activate the role in My roles. Activation triggers your rules for MFA, justification and approval.
• Active assignment: the user holds the role all the time, or until the assignment end date. No activation step is needed.

Both types can be permanent or time-bound. A time-bound eligible assignment suits a contractor on a six-month project. A permanent active assignment should be rare. Keep it for emergency access accounts and for service accounts that cannot activate roles.

A useful rule: if a person signs in as an admin, make them eligible. If a non-human process needs the role, find a narrower permission first.

How do approval, MFA and justification work in PIM?

Each role has its own role settings. You find them in the Microsoft Entra admin center under ID Governance, then Privileged Identity Management, then Microsoft Entra roles, then Roles. Select the role and choose Role settings. The settings that matter most are:

• Activation maximum duration: a slider from 1 to 24 hours. We set 1 to 4 hours for Global Administrator and 8 hours for day-to-day roles.
• On activation, require MFA: forces a fresh second factor before the role goes live.
• On activation, require Conditional Access authentication context: applies a Conditional Access policy at activation. Use it to demand phishing-resistant MFA or a compliant device.
• Require justification on activation: the user must type a business reason.
• Require ticket information: records a ticket number. PIM does not validate it against your ITSM tool.
• Require approval to activate: named approvers must approve each request. Microsoft recommends selecting at least two.
• Notifications: email alerts to admins, approvers and the user on assignment and activation.

Authentication context pairs well with your wider policy set. See our Conditional Access best practices for Microsoft 365 for the base policies to build first.

How do access reviews work with PIM?

Eligibility tends to grow over time. People change jobs and keep roles they no longer use. Access reviews fix this.

In PIM you can create an access review for any Entra role or Azure role. Reviewers can be the role members themselves, their managers or named people. Set a recurrence, such as quarterly. Turn on “auto apply results” so denied or unreviewed assignments are removed when the review ends. Reviews of privileged roles also need P2 or ID Governance licenses for the people in scope.

For audit work under ISO 27001 or the UAE Information Assurance (IA) Standard, the review history gives you evidence of periodic access recertification.

How to set up Entra PIM for Global Administrator: step by step

Follow these steps in order. Do step 1 before anything else, or you risk locking yourself out.

1. Create two emergency access accounts. Use cloud-only accounts on the .onmicrosoft.com domain. Assign Global Administrator as permanent active. Protect them with FIDO2 passkeys.
2. Confirm licenses. Assign Entra ID P2 or ID Governance to every admin, approver and reviewer.
3. Sign in as Privileged Role Administrator. Open the Microsoft Entra admin center and go to ID Governance, then Privileged Identity Management.
4. Review current assignments. Under Microsoft Entra roles, then Roles, open Global Administrator. List everyone with an active assignment.
5. Configure role settings. Set activation to 1 to 4 hours. Require MFA or an authentication context, justification and approval from two named approvers.
6. Convert active admins to eligible. For each named admin, add an eligible assignment, then remove the active one. Leave only the emergency accounts active.
7. Test activation. Have one admin activate the role through My roles. Check that the approver gets the request and the audit log records it.
8. Repeat for other high-impact roles. Next do Privileged Role Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator and Conditional Access Administrator.
9. Schedule access reviews. Create a quarterly review for each privileged role with auto apply turned on.

Microsoft warns of one specific lockout. If all Global Administrators and Privileged Role Administrators are eligible, approval is required, and no approvers are set, nobody can activate. Step 1 and named approvers prevent this.

PIM vs PAM: what is the difference in Microsoft?

People searching for privileged access management in Microsoft often find two products with similar names. They solve different problems.

Microsoft recommends using them together. PIM limits who holds a role and when. Purview PAM adds a finer approval layer for specific tasks. For on-premises Active Directory, neither tool replaces tiered admin models and dedicated admin workstations.

Best practices for Microsoft Entra Privileged Identity Management

These are the practices we apply most often when we harden client tenants.

• Keep Global Administrators under five. Microsoft guidance recommends fewer than five. Use narrower roles such as User Administrator or Helpdesk Administrator for routine work.
• Protect break-glass accounts properly. Exclude them from blocking Conditional Access policies. Store credentials in separate secure locations. Alert on every sign-in through Microsoft Sentinel or Azure Monitor. Test them at least every 90 days.
• Use cloud-only admin accounts. Do not sync privileged accounts from on-premises AD. A compromised domain should not hand over your tenant.
• Require phishing-resistant MFA at activation. Use an authentication context tied to an authentication strength policy.
• Treat Conditional Access Administrators as privileged. Anyone who can edit the authentication context policy can weaken your PIM controls.
• Put Azure subscriptions under PIM too. Owner and User Access Administrator on production subscriptions deserve the same rules as Global Administrator.
• Watch the PIM alerts. PIM flags roles assigned outside PIM, too many Global Administrators and roles that are not used.

We see three common mistakes in UAE and KSA tenants. Approvers are also the requesters. Activation windows sit at the maximum. Eligible assignments never expire. Each one weakens the control without anyone noticing. PIM logs also help with audits. They give useful evidence for privileged access controls under the Saudi NCA Essential Cybersecurity Controls and the UAE IA Standard.

For how PIM fits into your wider identity design, see what identity and access management (IAM) means in Microsoft 365.

Deploy Entra PIM With M365 Enterprise Hub

We design and roll out PIM for organizations in Dubai, Abu Dhabi, Riyadh and the USA. A typical project covers role discovery, emergency access accounts, role settings, approver design, access reviews and Sentinel alerting. We also handle the change management, so admins know how to activate roles from day one.

See our privileged access management services, our Microsoft Entra ID services in Dubai, and our identity and access hardening services.

Frequently Asked Questions

What is PIM in Microsoft Entra ID?

PIM, or Privileged Identity Management, is a Microsoft Entra service that gives admins just-in-time access to privileged roles. Users are made eligible for a role and activate it for a limited time. Activation can require MFA, justification and approval. Every activation and assignment is written to the audit log for later review.

Is Entra PIM included in Microsoft 365 E3?

No. Microsoft 365 E3 includes Microsoft Entra ID P1, which does not include PIM. You need Microsoft Entra ID P2 or Microsoft Entra ID Governance. Microsoft 365 E5 includes Entra ID P2. Many organizations on E3 buy P2 only for admins, approvers and reviewers, which keeps the cost low.

What is just-in-time access in Microsoft Entra?

Just-in-time access means a user holds no standing admin rights. They request the role when they need it, pass the required checks, and receive it for a set period, from 1 to 24 hours. When the time ends, the role is removed automatically. This limits how long a stolen admin account stays useful.

What is the difference between eligible and active roles in PIM?

An eligible role gives no rights until the user activates it, which triggers MFA, justification or approval rules. An active role is in force all the time or until its end date, with no activation step. Use eligible for named admins and keep active assignments for emergency access accounts only.

Should break-glass accounts be managed by PIM?

Microsoft recommends that emergency access accounts hold Global Administrator as a permanent active assignment, not eligible. They should be cloud-only, use FIDO2 passkeys, sit outside blocking Conditional Access policies and trigger an alert on every sign-in. Test them at least every 90 days so they work when you need them.

Does PIM work for Azure subscriptions as well as Entra roles?

Yes. PIM manages Azure resource roles such as Owner, Contributor and User Access Administrator at management group, subscription, resource group and resource scope. You first discover the Azure resources in PIM, then configure role settings and eligible assignments the same way you do for Microsoft Entra roles.