How to roll out Privileged Identity Management in Microsoft 365

Privileged Identity Management (PIM) lets people be eligible for a role and activate it only when needed, for a limited time. The access they get is the same as a permanent assignment, but only while activated.

• Roles: Privileged Role Administrator or Global Administrator to manage PIM settings and assignments. To only read, Global Reader or Security Reader is enough.
• Licences: PIM needs licences. Microsoft points to its Microsoft Entra ID Governance licensing page for the details, so check it for your plan before you start.
• Emergency access: have two break-glass accounts ready with permanent active Global Administrator. Microsoft warns you can lock yourself out if every admin is only eligible, approval is required and no approvers are set.
• Tools: the Microsoft Entra admin center and the Microsoft Graph PowerShell module for the checks.
• Plan: list who holds which admin roles today and who should approve activations. Choose at least two approvers.

Steps 1 and 2 only read. Steps 3 to 6 change your tenant and are marked CHANGE. Do them for one role at a time, starting with a low-risk role.

1. Take stock of permanent admins (read-only). In the Entra admin center go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, or run:

   Connect-MgGraph -Scopes "RoleAssignmentSchedule.Read.Directory","RoleEligibilitySchedule.Read.Directory"
   Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All |
     Where-Object AssignmentType -eq 'Assigned' |
     Select-Object PrincipalId, RoleDefinitionId, EndDateTime

   Rows with an empty EndDateTime are permanent assignments. These are the ones to convert.
2. Confirm emergency access and approvers (read-only). Make sure your break-glass accounts are excluded from the new rules and that the people you plan to name as approvers can sign in.
3. CHANGE: set the role settings. Sign in as at least Privileged Role Administrator. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, select the role, then Role settings > Edit. Set the Activation maximum duration (1 to 24 hours), turn on On activation, require multifactor authentication and Require justification on activation, and select Update. Settings are per role, so repeat for each role.
4. CHANGE: require approval for the most powerful roles. In the same Role settings page for Global Administrator and Privileged Role Administrator, turn on Require approval to activate and select at least two approvers. Do not leave the approver list empty and do not make every admin eligible-only without emergency access in place.
5. CHANGE: make people eligible. Go to Microsoft Entra roles > Roles > Add assignments, select the role and the member, choose Eligible as the assignment type, set start and end dates or a permanent eligibility, and select Assign. Ask each person to test activating the role (My roles > Activate) before you remove anything.
6. CHANGE: remove the permanent active assignment. Once the eligible assignment works, open the role, find the person under Active roles and select Remove. Microsoft notes you cannot remove the last active Global Administrator assignment. Then set up access reviews for privileged roles so eligibility does not pile up; PIM supports them.

These commands only read.

Connect-MgGraph -Scopes "RoleAssignmentSchedule.Read.Directory","RoleEligibilitySchedule.Read.Directory"
# Eligible assignments
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -All |
  Select-Object PrincipalId, RoleDefinitionId, EndDateTime
# Permanent active assignments that should now be only break-glass accounts
Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All |
  Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime } |
  Select-Object PrincipalId, RoleDefinitionId

The first list should contain your administrators. The second should shrink to your emergency access accounts and any service accounts you have consciously accepted. Match the PrincipalId and RoleDefinitionId values to names in the portal. Then watch the PIM audit history after the first activations.

• Making every Global Administrator eligible, requiring approval and naming no approvers. That can lock you out of the tenant.
• Removing the permanent assignment before the person has successfully activated the eligible one.
• Assuming role settings apply across roles. They are defined per role.
• Leaving long activation windows. Pick the shortest duration that works for the task.
• Pointing a Conditional Access policy at both an authentication context and a directory role. During activation the user does not hold the role yet, so the policy would not apply. Use separate policies.
• Assigning roles to a guest user and forgetting that, per Microsoft, a built-in role raises the guest to the same permissions as a member.
• Setting eligibility once and never reviewing it.

ConfigCobra is read-only and never changes your tenant. It reads Microsoft Graph with read-only permissions, so you can see whether privileged roles are activated rather than permanent, whether approval is required for Global Administrator and Privileged Role Administrator, and whether access reviews exist. The related checks below are part of the CIS Microsoft 365 Foundations Benchmark v7.0.0, which has 160 controls.

The Microsoft 365 inventory lists admins and directory roles, and ConfigCobra's daily scan alerts you by email if a control regresses later. For a failing control, remediation impact analysis shows who would be affected before you apply the fix yourself.