Microsoft Identity Manager and MIM PAM: Support Dates, Risks and Migration Paths

Microsoft Identity Manager 2016 is in its final support window, and its Privileged Access Management (PAM) component, built on a bastion forest, is no longer Microsoft's recommended way to protect privileged access in Internet-connected environments. Many organisations still run MIM for HR-driven provisioning, group management, self-service password reset and, in a smaller number of estates, MIM PAM with a separate PRIV forest trusted by production. This guide sets out the official timeline as Microsoft publishes it, how to find every system and identity that depends on MIM, the migration options towards Microsoft Entra ID Governance and Entra Privileged Identity Management, and how to test and roll back. It is written for identity architects, Active Directory engineers and PAM owners. For the wider discipline, see the Privileged Access Management Guide.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• The end date is 9 January 2029. Microsoft extended MIM 2016 support from 13 January 2026 to 9 January 2029; mainstream support ended in January 2021, so the product receives security and selected fixes only.
• MIM PAM is a niche pattern now. Microsoft states that MIM PAM is not recommended for new deployments in Internet-connected environments and positions it for isolated, regulated or disconnected estates such as OT and SCADA.
• Run the bastion trust to Tier 0 standards. The documented PAM trust enables SID history and turns off SID filtering quarantine, so operate the PRIV forest with Tier 0 controls to keep it a shield rather than a path into production.
• There is no single replacement product. Microsoft maps 14 MIM scenarios to separate Entra capabilities: inbound provisioning, the ECMA Connector Host, cloud sync group provisioning, entitlement management, access reviews and Entra PIM.
• Migrate in stages, privileged access last. Inventory first, move low-risk scenarios such as SSPR, then provisioning and groups, and retire the PAM trust only once a tested just-in-time model for Tier 0 is in place.

What is changing and why

MIM 2016 is a server product under Microsoft's Fixed Lifecycle Policy. It is made up of the MIM Synchronization Service, the MIM Service and Portal (a SharePoint-hosted portal and workflow engine), self-service password reset (SSPR) portals, Certificate Management (CM), the BHOLD role suite and the PAM components. Each depends on supporting software with its own lifecycle: SQL Server, SharePoint, Windows Server and, until recently, Entra Multifactor Authentication Server and Silverlight.

Two changes run in parallel. First, the product as a whole has a fixed end of extended support. Second, Microsoft's privileged access guidance has moved away from isolated administrative forests. The Enhanced Security Admin Environment (ESAE, often called red forest) recommendation has been replaced by the privileged access strategy and the rapid modernization plan (RAMP), and Microsoft now describes ESAE as a custom configuration suitable only for exception cases. MIM PAM is the tooling that implements just-in-time membership in such a bastion forest, so it inherits that change in status.

Official timeline and current status

All dates below are as published on Microsoft's lifecycle and MIM documentation pages, checked on 8 November 2026. Microsoft has moved the end date once already, so recheck the lifecycle page before committing a programme plan to a date.

• Entra ID P1 or P2 customers: Microsoft states they receive continued standard support when they use the MIM for Microsoft Entra Premium release (or the current hotfix) to prepare identities for AD that then synchronise to Entra ID.
• SP3 platform support: SP3 adds support for SharePoint Subscription Edition, Exchange Server SE, Outlook 2021, SQL Server 2022 and Azure SQL. Estates still on older SharePoint or SQL versions carry a second, earlier lifecycle risk than the MIM date itself.
• PAM in SP3: the SP3 release notes describe changes to the Synchronization Service and the Service and Portal; they list no PAM-specific changes. The last hotfix that named PAM explicitly was build 4.6.673.0 in October 2023.

Who and what is affected

• Joiner, mover, leaver pipelines: any HR feed that lands in AD through MIM management agents, including custom extension DLLs and rules extensions written in .NET.
• Group governance: criteria-based and owner-managed groups in the MIM Portal, and the approval workflows behind them.
• Password reset: SSPR registration and reset portals, especially where approvals or MFA used Entra MFA Server, which no longer works.
• Privileged access: admins who request Tier 0 or Tier 1 rights through New-PAMRequest, the PAM REST API or the PAM portal, and the production forests that trust the PRIV forest.
• Non-human identities: MIM runs on service accounts (the MIM Service, Sync, management agent and SharePoint pool accounts) and holds connector credentials for AD, SQL and LDAP targets. These are high-value machine credentials: the AD management agent account can typically create, modify and disable users. See the Group Managed Service Accounts (gMSA) Guide.
• Auditors and regulators: evidence for access recertification and privileged access approval often comes from MIM request history. A migration that drops that history breaks the audit trail.

Finding affected systems and identities

Build the inventory before any design work. The queries below are described as read-only discovery; run them with an account that has read access only.

Two checks are often missed. First, members of production privileged groups who are present only because PAM added a time-limited membership should show as expiring links; any permanent members found alongside them are standing access that the PAM project never removed. Second, review who administers the PRIV forest itself: its Domain Admins effectively control privileged access to every trusting forest. The BloodHound and Active Directory Attack Path Guide explains how to see that path.

Migration options

Microsoft's own migration article maps MIM scenarios to Entra capabilities one by one and recommends a staged approach, for example moving SSPR first and provisioning later. The main choices are below.

Replacing MIM PAM specifically

• Cloud and Entra roles: Entra PIM provides just-in-time and time-bound assignment, approval, MFA on activation, justification, notifications, access reviews and audit history for Entra roles, Azure resource roles and PIM for Groups. See the Privileged Identity Management (PIM) Guide.
• On-premises AD groups: Entra cloud sync can provision cloud security groups into AD so Kerberos applications see the membership, and Microsoft documents access packages driving that membership. It has hard limits: Universal scope only, 50,000 members, and it cannot manage Domain Admins, Enterprise Admins, Schema Admins or Protected Users. It does not replace Tier 0 just-in-time in AD.
• Tier 0 in AD: for the most sensitive groups, Microsoft's securing privileged access guidance points to reducing standing membership, privileged access workstations, strong authentication and least-privilege role design rather than a bastion forest. Many organisations pair that with a PAM vault or a just-in-time product for AD. See the JIT Access Guide and the Privileged Access Workstations Guide.
• Kerberos ticket lifetime: MIM PAM's documented PRIV forest sets the maximum user ticket lifetime to 1 hour so that time-limited membership expires promptly. Any replacement that adds and removes group membership has the same issue: existing tickets keep the old membership until they expire, so set ticket lifetime and purge expectations deliberately.

Decision guidance by size

• Small estates (one forest, a few hundred users): MIM is often used only for SSPR or simple group rules. Moving to Entra SSPR and dynamic groups can be done in weeks, and MIM PAM, if present, is usually better removed than replaced like for like.
• Large estates (multiple forests, HR feeds, custom MAs): treat it as a programme. Migrate per scenario, keep MIM authoritative for the rest, and run both in parallel with a clear source of authority for every attribute.
• Isolated estates: plan the 2029 end for those environments now; disconnected networks cannot adopt cloud services, so the replacement will be a supported on-premises product or a redesigned admin model.

Testing and rollback

1. Baseline: export every MA, sync rule, MPR, workflow and PAM role; take SQL backups of the MIM Service and Sync databases; record current group memberships for every governed group.
2. Pilot scope: pick one scenario and one population, for example SSPR for one business unit, or one access package for one Kerberos application group.
3. Shadow run: for provisioning, run the Entra path to a test OU or in preview, and compare attribute values against MIM output before switching source of authority.
4. Switch authority per attribute: disable the corresponding MIM export flow or MA run profile only after the Entra flow is proven, so MIM and Entra never write the same attribute at once.
5. PAM cutover: enrol administrators in the new just-in-time model, confirm activation and approval end to end, run both in parallel for at least one change cycle, then remove PAM roles one group at a time.
6. Remove the trust last: once no PAM role is active, remove the PRIV forest trust from production forests and confirm SID filtering is back to its default on any remaining trusts. See the Active Directory Trusts and SID Filtering Guide.
7. Rollback: keep MIM servers, databases and run profiles intact but disabled until the new path has completed a full access review cycle; rollback is re-enabling the MIM run profile for the scenario and suspending the Entra provisioning job.
8. Decommission: after sign-off, disable and then delete MIM service accounts, revoke connector credentials, remove SPNs, and archive request history for audit.

Risks of doing nothing

• Unsupported Tier 0 software: after 9 January 2029 a server that can create and modify AD accounts, and in PAM estates grant Domain Admin equivalent rights, receives no security fixes. NIST SP 800-53 SA-22 expects such components to be replaced or formally justified.
• Trust boundary settings: the PAM trust is configured with SID history enabled and quarantine disabled. Attackers who compromise the PRIV forest can abuse that trust; MITRE ATT&CK tracks SID-History Injection as T1134.005 and Golden Ticket as T1558.001.
• Broken approvals already: estates that relied on Entra MFA Server for PAM approvals or SSPR have had no working MFA there since 30 September 2024 unless they changed method.
• Orphaned machine credentials: MIM management agent accounts often hold broad write rights in AD and other directories, and are rarely rotated. A forgotten MIM server is a ready-made path for account manipulation (T1098).
• Lost audit trail: if MIM fails or is switched off in a hurry, request and approval history that auditors rely on may become unreadable.

Measure progress with: percentage of MIM scenarios migrated, number of active MIM management agents, count of standing members in Tier 0 groups, number of PAM roles still active, number of MIM service accounts not yet decommissioned, and median activation time in the new just-in-time model. Watch the Active Directory Security Monitoring and Event IDs Guide events during cutover for unexpected group changes.

Practitioner checklist

• Confirm current builds and plan to SP3 (4.7.6.0) or MIM for Entra Premium (4.7.9.0) now, and recheck the 9 January 2029 date on the lifecycle page each quarter.
• Export every management agent, sync rule, MPR, workflow and PAM role into a scenario inventory with an owner per scenario.
• List every MIM service and connector account, its rights and its last password change, and put them under NHI governance.
• Replace any approval or SSPR step that still depended on Entra MFA Server.
• Map each scenario to the Entra capability Microsoft names, and mark the gaps that need a custom or third-party solution.
• Migrate low-risk scenarios first (SSPR, dynamic groups), then provisioning, then governance, then privileged access.
• Design Tier 0 just-in-time for AD before removing MIM PAM, and test ticket lifetime behaviour.
• Remove the PRIV forest trust only after PAM roles are empty, and confirm SID filtering on remaining trusts.
• Archive MIM request and approval history in a readable format before decommissioning.

Standards and references

• Microsoft Learn: Microsoft Identity Manager 2016 lifecycle
• Microsoft Learn: Microsoft Identity Manager 2016 overview and support
• Microsoft Learn: Migrating identity and access management scenarios to Microsoft Entra from Microsoft Identity Manager
• Microsoft Learn: Privileged Access Management for Active Directory Domain Services
• Microsoft Learn: Enhanced Security Admin Environment retirement
• Microsoft Learn: What is Microsoft Entra Privileged Identity Management
• Microsoft Learn: Govern on-premises Active Directory based apps using Entra ID Governance
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Privileged Access Management Guide · Entra ID Entitlement Management and Access Packages Guide · Microsoft Entra Connect and Cloud Sync Hardening Guide · Break-Glass Account Guide