Privileged Identity Management: admin rights only when needed

In many Microsoft 365 environments, several accounts have full administrator rights around the clock. They may only need those rights once a month. Anyone who takes over one of these accounts can change the entire tenant, read mailboxes and delete backups. Privileged Identity Management, PIM for short, grants administrator rights only when they are needed, and only for a few hours.

Sources: Microsoft Learn, as of October 2026.

Why permanent administrator rights are a risk

An administrator account is the most valuable target in a tenant. Whoever takes it over can create new accounts, read mailboxes, switch off protection features and delete data. If the role stays active, one successful attack is enough. It might be a phishing email, an intercepted sign-in or an account nobody uses any more and whose weak protection goes unnoticed.

Microsoft experienced how quickly this happens in early 2024. Attackers used an old test account without multifactor authentication to take over an application with far-reaching permissions and used it to read mailboxes of senior leadership.

How Privileged Identity Management works

With PIM, an administrator no longer has their role permanently assigned but is eligible for it. When they need it, they activate it in the Entra admin center. Once the configured time has passed, the role is removed automatically.

How an administrator role is activated

My usual settings, adjustable per role.

1. Requestadministrator needs the role
2. Sign-in and justificationmultifactor, reason is mandatory
3. Approvalfor Global Administrator by a second person
4. Role activeusually 1 to 4 hours
5. Role removedautomatically, with audit log

Privileged Identity Management also warns about roles assigned outside PIM or too many Global Administrators. It also flags accounts that have not used their roles for a long time and roles activated unusually often. Time-bound assignments, for example for a provider during a project, expire on their own. PIM sends a reminder 14 days and one day beforehand.

Deep divePIM for groups and Azure

Privileged Identity Management does not only apply to roles in Entra ID. With PIM for Groups, several roles can be bundled in one group, so that a single activation is enough. If you use Azure, you manage roles for subscriptions and resources there in the same way.

The audit history in PIM goes back 30 days. If you need to evidence activations for longer, forward the logs to a Log Analytics workspace.

Which licence PIM requires

Privileged Identity Management is part of Microsoft Entra ID P2. Business Premium only includes Entra ID P1 and therefore no PIM. Every account eligible for a role or assigned one temporarily needs a P2 licence. So does every person who approves activations. Other employees do not need one.

Where the P2 licence comes from

What does your organisation need besides PIM?

Only protection for admin accounts

Entra ID P2only for administrators and approvers

Extended protection for everyone as well

Defender Suite for Business Premiumincludes Entra ID P2 and several Defender plans

For my clients, I usually license Entra ID P2 for administrators only. For a small business that means just a few licences, and the protection covers exactly the accounts that matter.

What Business Premium offers without PIM

Even without P2, administrator accounts can be protected well. Business Premium includes Conditional AccessRules that define who may sign in from which device and location, and with which authentication method. for this. What is missing is time-limited activation. That is why I proceed in this order:

Protecting administrator accounts, step by step

1. Emergency access accountstwo cloud-only accounts, permanent administrators, with a passkey
2. Separate admin accountsno mailbox, not used for everyday work
3. Phishing-resistant sign-invia Conditional Access for all admin roles
4. Clean-upfewer than five Global Administrators, smaller roles otherwise
5. PIMroles only for a limited time, with justification and approvalwith Entra ID P2

The first four steps are possible with Business Premium and are worthwhile in every tenant. Privileged Identity Management builds on them. Providers receive their rights through Partner Center on a time-limited basis and restricted to individual roles anyway, via granular delegated admin privileges (GDAP). More on this in the article Changing your IT provider.

Emergency access accounts: the way back into the tenant

If all administrators are only eligible and multifactor authentication fails, or a policy accidentally locks everyone out, you need a way back in. That is what two emergency access accounts are for. These accounts remain Global Administrators and do not go through PIM. They sign in with a passkey and are exempt from blocking Conditional Access policies. Microsoft recommends alerting on every sign-in with them and testing the accounts at least every 90 days.

How well are your admin accounts protected?

Four questions about your administrator accounts

One minute, no sign-up.

Do you know who is a Global Administrator in your tenant?

Yes, exactly Roughly No

Are there fewer than five?

Yes No Don’t know

Do administrators work with separate admin accounts without a mailbox?

Yes No

Are there two tested emergency access accounts?

Yes No Don’t know

Answer all questions to see the assessment.

Action is needed here

A compromised admin account would have free rein in your tenant. I will show you where to start. Arrange a consultation

A good foundation, with gaps

The key steps are only missing in a few places. These gaps can be closed quickly. Arrange a consultation

Well positioned

The next step is PIM, so that roles are only active for a limited time.

How I proceed

1. Assessment: Who holds which role, since when, and is it used? This is also part of my Microsoft 365 audit.
2. Clean-up: Create emergency access accounts, set up separate admin accounts, remove unnecessary roles, use smaller roles instead of Global Administrator.
3. Set up PIM: Convert roles to eligible, define duration, justification and approvals per role, switch on notifications.
4. Training: I show your administrators how to activate roles and your approvers how to approve requests.

Frequently asked questions

What happens if the P2 licence expires?

Microsoft then removes all eligible assignments, and time-bound active assignments become permanent. Administrators who could only activate their role no longer have it at all. That is why the emergency access accounts matter, and the licence should not expire unnoticed.

Does this make work more cumbersome for administrators?

Somewhat. Before starting work, they need to sign in and give a justification, and for Global Administrator also obtain approval. For smaller roles Microsoft suggests longer durations, such as two hours for Exchange Administrator and eight hours for Helpdesk Administrator, without approval.

Do all employees need a P2 licence?

No. A licence is only required for accounts that are eligible for a role and for the people who approve activations. In a small business that is usually just a few accounts.

Sources

• Licensing for PIM: Microsoft Learn – Microsoft Entra ID Governance licensing fundamentals, Microsoft Learn – Microsoft Entra licensing (as of October 2026)
• Defender Suite for Business Premium: Microsoft Learn – Add Microsoft Defender Suite to Business Premium (as of October 2026)
• Features and settings: Microsoft Learn – Plan a PIM deployment, Microsoft Learn – What is Privileged Identity Management?, Microsoft Learn – Configure role settings, Microsoft Learn – Security alerts, Microsoft Learn – Audit history (as of October 2026)
• Recommendations for roles: Microsoft Learn – Best practices for Microsoft Entra roles (as of October 2026)
• Emergency access accounts: Microsoft Learn – Manage emergency access accounts (as of October 2026)
• Phishing-resistant sign-in for administrators: Microsoft Learn – Require phishing-resistant MFA for administrators (as of October 2026)
• Effectiveness of multifactor authentication: Microsoft Learn – Mandatory multifactor authentication (as of October 2026)
• Attack on Microsoft in 2024: Microsoft Security Response Center – Midnight Blizzard (as of October 2026)
• Delegated rights for providers: Microsoft Learn – Granular delegated admin privileges (as of October 2026)