Privileged Identity Management (PIM) Guide: Eligible Assignments

A permanent Global Administrator assignment gives an attacker who steals that account every privilege the role holds, at any hour, with no further check. Microsoft Entra Privileged Identity Management (PIM) replaces that standing access with eligible assignments that must be activated, for a limited time, behind multi-factor authentication, justification and, where needed, approval. This guide goes deeper than the Privileged Access Management Guide on one platform control. It covers Microsoft Entra roles, Azure resource roles and PIM for Groups, the settings that matter, approval, alerts, audit, access reviews, licensing and a rollout that avoids lockout. It is written for Entra ID administrators, identity architects and security teams.

Key takeaways

• Eligible is not weaker access, it is access you have to ask for. Microsoft states there is no difference in the access an eligible and a permanent assignment give; the difference is that the eligible user activates only when needed, through the checks you configure.
• Role settings carry the security. Activation maximum duration (1 to 24 hours), MFA or a Conditional Access authentication context, justification, ticket information and approval are set per role, so the Global Administrator role should not share the Helpdesk Administrator's settings.
• Use an authentication context for passwordless PIM. Pairing activation with a Conditional Access authentication context that requires the phishing-resistant authentication strength and sign-in frequency "Every time" forces a fresh passkey or certificate sign-in on every activation.
• PIM can be bypassed if you let it. Assignments made outside PIM, Conditional Access administrators who can weaken the activation policy and permanent active exceptions all undo the model; the "Roles are being assigned outside of Privileged Identity Management" alert is rated High for that reason.
• Plan licences, approvers and emergency access before enforcement. Eligible users, approvers and reviewers need Microsoft Entra ID P2 or Microsoft Entra ID Governance, and requiring approval with no approvers and no active administrator can lock you out of the tenant.

What PIM manages: three surfaces

Microsoft Entra PIM (Entra ID PIM, formerly Azure AD PIM) covers Microsoft Entra ID, Azure and Microsoft Online Services such as Microsoft 365 and Intune, through three surfaces with different owners. The Azure resource surface is what many teams call Azure PIM.

The role that controls PIM itself is the Privileged Role Administrator, which Microsoft describes as able to "manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management". Its holder can change settings, approvers and assignments for every other role, so protect it like Global Administrator. PIM prevents removal of the last active Global Administrator and Privileged Role Administrator assignments.

Eligible versus active assignments

Every PIM assignment has a type (eligible or active) and a duration (permanent or time-bound). Microsoft's definition of eligible is the key line for anyone explaining PIM to auditors: "There's no difference in the access given to someone with a permanent versus an eligible role assignment. The only difference is that some people don't need that access all the time."

Two constraints shape the design. First, service principals cannot be made eligible for Entra roles, Azure roles or PIM for Groups, only given time-limited active assignments, so workload privilege needs other controls. See the Azure RBAC and Service Principals Guide. Second, PIM "can't enforce multifactor authentication when the user uses their role assignment because they're already active in the role from the time that it's assigned", which is why the deployment plan recommends zero permanently active assignments other than emergency access accounts.

Users can request to extend an assignment nearing its end or renew an expired one; both need approval from a Global Administrator or Privileged Role Administrator, which turns expiry into a lightweight recertification.

PIM settings: activation, assignment and notification

Role settings (the PIM policy for a role) are where activation becomes meaningful. You need at least Privileged Role Administrator to change them for Entra roles; in Microsoft Graph they are exposed as rules on the unifiedRoleManagementPolicy resource, which makes them auditable as configuration. The PIM default settings are permissive enough that each high-impact role should be reviewed individually.

Microsoft's deployment example gives Global Administrator a one-hour activation with ticket and approval by another Global Administrator, Exchange Administrator two hours without approval, and Helpdesk Administrator eight hours. The more a role can change identity or security policy, the shorter and more gated its activation should be.

Passwordless privileged identity management

The plain MFA setting accepts whatever MFA the user already satisfied, including phishable methods. To make activation passwordless and phishing-resistant, Microsoft documents using "On activation, require Microsoft Entra Conditional Access authentication context together with Authentication Strengths". The pattern:

1. Create an authentication context (for example "PIM high privilege").
2. Create a Conditional Access policy that targets that context and requires the built-in Phishing-resistant MFA authentication strength (passkeys or FIDO2 security keys, Windows Hello for Business, certificate-based authentication).
3. Set the session control sign-in frequency to Every time so each activation reauthenticates; Microsoft notes a 10-minute window applies after one reauthentication.
4. Select the context in the role's activation settings.

Two cautions from Microsoft. Do not scope the policy to both the authentication context and a directory role: during activation the user does not yet hold the role, so it will not apply. And if no policy targets the context, PIM falls back to standard MFA, so a deleted policy silently weakens activation. Microsoft also warns that principals who can manage Conditional Access, such as Conditional Access Administrators or Security Administrators, "can change requirements, remove them, or block eligible users from activating the role" and "should be considered highly privileged". Keep the separate Conditional Access policy that requires phishing-resistant MFA for administrators as well; see the MFA Guide for method strength.

PIM role activation and the PIM approval workflow

Privileged role activation starts from My roles in the Entra admin center or through Microsoft Graph (a selfActivate request to roleAssignmentScheduleRequests). PIM activation can narrow the scope, set a custom start time, and records the reason (activation justification) and any ticket. Behaviour worth knowing:

• Timing: the active assignment is created and removed "within seconds", though some applications only reflect it after the user signs in again. Users can deactivate early, but not within five minutes of activation; encourage it, because an unused window is standing privilege.
• Approval window: approvers have 24 hours, which is not configurable; after that the user must submit a new request.
• Who decides: requests are resolved by the first approver who approves or denies, and all approvers are notified of the outcome. Multi-step approval is not supported.
• Self-approval: approvers cannot approve their own requests, and service principals cannot approve. With no approvers selected, active Privileged Role Administrators and Global Administrators approve.

Microsoft warns of one serious failure mode: tenant lockout when all Privileged Role Administrators and Global Administrators are eligible with none active, approval is required and no approvers are configured. Avoid it with permanently active emergency access accounts and named approvers. See the Break-Glass Account Guide.

PIM for Groups

PIM for Groups grants just-in-time membership or ownership of a group. Each enabled group has two policies, one for activation of membership and one for activation of ownership, with the same controls as role activation. Any Entra security group or Microsoft 365 group can be enabled except dynamic membership groups and groups synchronised from on-premises; the group does not have to be role-assignable. More than 500 groups can be enabled per tenant, but only up to 500 of them can be role-assignable.

Role-assignable groups matter because they can hold Entra roles, and only Global Administrators, Privileged Role Administrators or the group owner can manage them; other administrators cannot reset the credentials of their members, even eligible ones who have not activated. They cannot contain nested groups. Microsoft describes two patterns:

• Active members, eligible group-to-role assignment: users are permanent members and the group is eligible for the role. Microsoft recommends this for roles that grant SharePoint, Exchange or Microsoft Purview access, because the alternative can take "significant time" for all permissions to become usable.
• Active group-to-role assignment, eligible membership: the group always holds the role and users activate membership, so one activation can grant a bundle of roles.

For groups used to elevate into Entra roles, Microsoft recommends requiring approval for eligible member assignments. Where the group feeds application provisioning, activated membership is provisioned in 2 to 10 minutes. A group owner can add members, so ownership of these groups should itself be eligible, not permanent.

PIM alerts, audit history and detection

PIM raises seven security alerts for Entra roles. Only Global Administrator, Privileged Role Administrator, Global Reader, Security Administrator and Security Reader can read them, and thresholds are tunable.

Treat the High alert as an incident trigger: a role assigned directly skipped every PIM control. MITRE ATT&CK tracks this behaviour as T1098.003 Additional Cloud Roles, and its mitigation M1026 suggests using PIM to require two or more approvals before roles are assigned. Its detection strategy DET0277 includes flagging users granted elevated Entra roles after suspicious sign-ins.

Audit history: PIM's Resource audit and My audit views show 30 days. Route Entra audit logs through Diagnostic Settings to Log Analytics or storage for longer retention and correlation. Microsoft advises correlating an activation cycle on roleAssignmentRequestId rather than CorrelationId, which can change across scheduled or approval-gated activations. Useful detections in words:

• Any "Add member to role" event that is not part of a PIM activation or recorded assignment request.
• Activation of Global Administrator or Privileged Role Administrator outside working hours or from an unmanaged device, followed by new role assignments, application credentials or Conditional Access changes.
• Changes to role settings and to the Conditional Access policy behind the authentication context.

Feed these into identity threat detection; see the ITDR Guide.

PIM access reviews

Eligibility accumulates just as permanent assignments did. PIM access reviews of Entra roles (created by a Privileged Role Administrator) and Azure resource roles (created by an Owner or User Access Administrator) recertify it.

• Scope: users and role-assignable groups, users, or service principals (which needs Microsoft Entra Workload ID Premium as well). A review can be limited to users inactive for up to 730 days.
• Assignment type: eligible only, active only, or all active and eligible. Review eligible assignments too; they are the standing population in a mature PIM tenant.
• Frequency: one time, weekly, monthly, quarterly, semi-annually or annually; a monthly review can run for at most 27 days.
• Reviewers: selected users, self-review or managers. Self-review is weak evidence for privileged roles; use role owners or security.
• Upon completion: enable "Auto apply results to resource" and choose what happens if reviewers do not respond: no change, remove access, approve access or take recommendations. Recommendations are based on sign-in in the last 30 days.

No access changes until a review completes, so an abandoned review removes nothing. For the wider certification process, see the Access Reviews Guide.

Licensing

Microsoft states: "You need either Microsoft Entra ID Governance licenses or Microsoft Entra ID P2 licenses to use PIM and all of its settings." Licences are needed for users with eligible or time-bound role assignments, PIM for Groups members and owners, approvers, users assigned to an access review, and reviewers; Microsoft's example of 42 eligible roles, 5 approvers and 6 reviewers needs 53. Core PIM, PIM for Groups and PIM Conditional Access controls are in both editions; custom extensions for role activation (preview) and access reviews of PIM for Groups (preview) are ID Governance only. If the licence lapses, PIM features stop working.

Implementing PIM: a phased rollout

1. Inventory. Export every Entra role assignment, Azure Owner and User Access Administrator assignment and role-holding group; list service principals separately.
2. Prepare emergency access. Two cloud-only emergency accounts with permanent active Global Administrator and alerting on every sign-in, before approval is enabled anywhere.
3. Configure, then convert. Set role settings, approvers and notifications first; test the authentication context policy in Conditional Access report-only mode.
4. Pilot. Convert a few administrators and test MFA, approval, notification and expiry with test users covering a role member, a group member, a resource owner and a group owner.
5. Roll out Entra roles. Global Administrator and Security Administrator first (Microsoft's priority), then every role with the Privileged label, then the rest.
6. Roll out Azure. Make Owner and User Access Administrator eligible one subscription at a time, including less critical ones.
7. Add groups and reviews. Enable PIM for Groups for role-holding groups, tune alerts and schedule reviews.
8. Roll back if needed. Per role, select the eligible user and choose Make active; the step 1 export tells you exactly what to restore.

Decision guidance

• Approval or not: require approval where one activation can change identity, authentication or policy for everyone. For high-frequency operational roles, approval mostly trains approvers to click; use short durations, justification and monitoring instead.
• Direct role eligibility or PIM for Groups: direct eligibility is simplest and clearest in audit. Groups suit teams that need a bundle of roles together or access across Entra, Azure and applications in one activation.
• Small organisations: eligible Global Administrator with a one-hour window, one named approver with emergency accounts as backstop, and a quarterly review; licences are needed only for those few users.
• Large organisations: manage role settings as code through Graph, scope roles to administrative units, and take approvers from a security function rather than peers in the same team.

Measuring PIM

• Standing privilege ratio: permanent active privileged assignments (excluding emergency accounts) against eligible ones, target zero.
• Global Administrator count: Microsoft's best practice is fewer than five, and fewer than ten privileged role assignments overall.
• Outside-PIM assignments: count of High alerts per month and time to investigate each.
• Activation hygiene: median activation length against the configured maximum, and share with a valid ticket.
• Review completion: privileged reviews completed on time, and eligible assignments removed per cycle.
• Phishing-resistant coverage: share of high-impact roles whose activation requires the phishing-resistant authentication strength.

Common failure patterns

• Converting roles without changing settings: 24-hour activation, MFA satisfied by an earlier sign-in and no approval add friction without protection.
• Assignments outside PIM: scripts or migration tools assign roles directly and nobody acts on the High alert. A new Global Administrator created this way gives an attacker full control, as in the Stryker Intune wiper attack, where an attacker with an administrator account created a new Global Administrator and wiped devices through Intune.
• Unprotected policy owners: Conditional Access Administrators and group owners outside PIM can weaken activation controls.
• Forgetting Azure: Entra roles are eligible while subscription Owner and User Access Administrator remain permanent on dozens of subscriptions.
• Reviews without consequences: reviews run with "No change" when reviewers do not respond, so eligibility only ever grows.

Framework mapping

Practitioner checklist

• Create two cloud-only, permanently active emergency access accounts before enabling approval on any role.
• Make every privileged Entra role and every Azure Owner and User Access Administrator assignment eligible, with end dates.
• Set activation to 1 or 2 hours with justification for roles that can change identity or security policy, and require approval from named approvers.
• Require a Conditional Access authentication context with the phishing-resistant authentication strength and sign-in frequency "Every time" for the highest roles.
• Bring Conditional Access Administrators, Privileged Role Administrators and owners of role-assignable groups under PIM.
• Investigate every "Roles are being assigned outside of Privileged Identity Management" alert as a potential incident.
• Export Entra audit logs to Log Analytics and alert on direct role assignments and role setting changes.
• Schedule quarterly PIM access reviews of eligible and active assignments with auto-apply and "Remove access" for non-response.
• Confirm P2 or ID Governance licence counts cover eligible users, approvers and reviewers.

Standards and references

• Microsoft Learn: What is Microsoft Entra Privileged Identity Management?
• Microsoft Learn: Configure Microsoft Entra role settings in Privileged Identity Management
• Microsoft Learn: Plan a Privileged Identity Management deployment
• Microsoft Learn: Privileged Identity Management for Groups
• Microsoft Learn: Configure security alerts for Microsoft Entra roles in PIM
• Microsoft Learn: Microsoft Entra ID Governance licensing fundamentals
• MITRE ATT&CK: T1098.003 Account Manipulation: Additional Cloud Roles
• NIST SP 800-53 Rev. 5: AC-6 Least Privilege

Related NHI Mgmt Group resources: Privileged Access Management Guide · JIT Access Guide · Microsoft 365 Security Guide · Microsoft Azure Security Guide