How to Configure Azure Active Directory (Entra ID) Privileged Identity Management (PIM) for Just-In-Time Access

Permanent administrative privileges—often referred to as Standing Privileges—are the primary target for attackers compromising Microsoft 365 and Azure environments. If an account holding the Global Administrator role is compromised, the attacker instantly gains total control over the tenant. To mitigate this risk, Microsoft provides Privileged Identity Management (PIM) within Microsoft Entra ID (formerly Azure AD).

PIM enforces the principle of Zero Trust by ensuring that administrators operate with standard user rights by default. When administrative tasks are required, they must explicitly “activate” their privileged role for a temporary, time-bound period (Just-In-Time access), subject to approval and Multi-Factor Authentication (MFA).

Understanding PIM Architecture

Privileged Identity Management fundamentally changes how roles are assigned in Entra ID and Azure Resource Manager (ARM).

• Eligible Assignment: The user is authorized to use a role, but the role is not currently active. The user has no administrative power.
• Active Assignment: The user has completed the activation requirements (e.g., MFA, ticketing justification, or manager approval) and the role is bound to their token for a specific duration (e.g., 2 hours).

When the duration expires, the token is revoked, and the user returns to an unprivileged state automatically.

Prerequisites for PIM Configuration

To configure and deploy PIM, your tenant must meet the following requirements:

• A Microsoft Entra ID Premium P2 license is required for every user who will be eligible for a role, as well as the administrators configuring the policies.
• The administrator configuring PIM must hold the Privileged Role Administrator or Global Administrator role.

Step 1: Enabling and Discovering PIM

If PIM has never been used in your tenant, you must consent to the service.

1. Navigate to the Microsoft Entra admin center (entra.microsoft.com).
2. Search for and select Privileged Identity Management.
3. Click on Consent to PIM (if prompted) and verify your identity using MFA.

Step 2: Configuring Role Settings (The PIM Policy)

Before making users eligible for a role, you must define the security constraints for that role. We will configure the Exchange Administrator role to require MFA and limit activation to 4 hours.

1. In the PIM dashboard, under Manage, select Microsoft Entra roles.
2. Click on Settings (the gear icon) in the navigation menu.
3. Search for and select the Exchange Administrator role.
4. Click Edit at the top of the settings page.

Configure the Activation tab:

• Activation maximum duration: Set this to 4 hours.
• On activation, require: Select Microsoft Entra multifactor authentication.
• Require justification on activation: Set to Yes (this forces the admin to enter a ticket number).
• Require approval to activate: Set to No for this example (if set to Yes, a designated manager must manually approve the request before the role activates).

Click Update to save the policy.

Step 3: Assigning Eligible Roles to Users

With the policy defined, you can now remove standing privileges and replace them with Eligible assignments.

1. In the PIM dashboard, under Microsoft Entra roles, click Roles.
2. Select Exchange Administrator.
3. Click Add assignments.
4. Select member(s): Choose the IT staff member who requires this access.
5. Click Next.
6. Assignment type: Ensure this is set to Eligible (Not Active).
7. Assignment duration: You can make them permanently eligible to activate, or set the eligibility itself to expire after 6 months.
8. Click Assign.

Step 4: Activating the Role (End-User Experience)

From the IT administrator’s perspective, they will log in with standard access. When they need to manage Exchange, they must activate their role.

1. The user navigates to the Entra admin center and opens Privileged Identity Management.
2. Under Tasks, they select My roles.
3. They will see Exchange Administrator listed under their Eligible assignments.
4. They click Activate.
5. If they have not satisfied MFA in their current session, PIM will prompt them to authenticate.
6. A pane opens requiring them to enter a Reason (e.g., “Ticket #4492 – Updating Mailbox Rules”) and adjust the slider for how many hours they need (up to the 4-hour maximum).
7. They click Activate.

Entra ID will process the request (which takes a few seconds) and instruct the user to refresh their browser. Their current session token is now populated with the Exchange Administrator claim.

Step 5: Auditing PIM Activity

One of the primary benefits of PIM is the immutable audit trail it generates. To review who activated what role and why:

1. In the PIM dashboard, select Microsoft Entra roles.
2. Under Activity, click My audit history or Resource audit.
3. You will see a complete log of every activation request, the justification provided, the IP address, and the exact time the role was deactivated.

Conclusion

Implementing Privileged Identity Management is a mandatory step for securing Microsoft Entra ID environments. By stripping standing privileges and enforcing Just-In-Time access bound by MFA and auditing, you dramatically reduce the attack surface and prevent lateral movement in the event of credential compromise.