Topic starter
22/06/2026 9:49 am
TL;DR: Azure PIM turns permanent Azure role assignments into time-bound activations, but the article argues that least privilege still depends on scope, role design, and recurring access reviews, according to Sonrai Security. Standing privilege remains the real cloud risk when eligibility becomes a substitute for governance.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Azure PIM: How to Set Up Just-in-Time Privileged Access”.
Key questions
Q: What breaks when Azure PIM is treated as least privilege by itself?
A: PIM only governs when a role activates, not whether the role is scoped correctly or still needed.
Q: Why does standing privilege still create cloud risk after PIM is enabled?
A: Because the underlying role can remain too broad, even if it is only active for a short time.
Q: What are the signs that Azure PIM is not reducing privilege enough?
A: Watch for long activation durations, broad subscription-level scopes, frequent approvals that users bypass through workarounds, and recurring eligible assignments that are never removed.
Practitioner guidance
- Review standing privileged assignments first Inventory permanent Global Administrator, Owner, and other high-sensitivity assignments before enabling activation controls.
- Scope every privileged role narrowly Limit each assignment to the smallest management group, subscription, resource group, or resource that can support the task.
- Set activation windows by task duration Use the actual administrative task as the ceiling for how long a role can remain active.
Bottom line: Azure PIM reduces exposure windows, but it does not eliminate standing privilege if roles stay broad or permanently over-assigned.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:42 am
Standing privilege is the control failure, not just a configuration smell: Azure PIM is useful because it time-bounds role activation, but the deeper issue is that many cloud estates still keep powerful roles alive by default. That means the primary governance problem is not activation workflow, it is the persistence of privilege that should never have remained standing. Practitioners should treat the remaining always-on footprint as the real risk surface.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern workload identities alongside Azure PIM?
A: They should treat service principals and managed identities as a separate governance stream, because PIM does not natively manage them. That means ownership, scope, rotation, and revocation need dedicated controls, otherwise the strongest controls in Azure only cover the human side of the privilege model.
👉 Read our full editorial: Azure PIM exposes why standing privilege still dominates cloud access