HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Identity & access

Do we need Privileged Identity Management for admin accounts?

By Accred Consulting Microsoft 365 Practice | Company facts

Short answer

If more than a couple of people hold admin roles in Microsoft 365, Privileged Identity Management is worth it. PIM replaces standing admin rights with time-limited, approved and logged activation, which shrinks the damage from a compromised admin account. It needs Entra ID P2 or Entra ID Governance licensing for the users who are eligible for roles.

Key facts

  • PIM makes admins eligible for a role and activates it only when needed, for a set number of hours.
  • Activation can require MFA, a justification, a ticket number and approval.
  • PIM needs Entra ID P2 or Entra ID Governance; Business Premium and E3 include P1, not P2.
  • Global Administrator should be held by very few people, ideally two to four plus break-glass accounts.
  • Without PIM, use separate cloud-only admin accounts, least-privilege roles and strict Conditional Access.

What PIM actually does

In most tenants, admins hold their roles permanently. If an attacker phishes one of those accounts, they get Global Administrator or Exchange Administrator rights immediately. PIM changes that model.

With PIM, a user is made eligible for a role rather than permanently assigned. When they need it, they activate the role in the Entra admin center, satisfy whatever the policy requires, and get the rights for a limited window. When the window ends, the rights go away. Every activation is logged and can trigger an alert.

  • Eligible and time-bound assignments for Entra ID and Azure roles
  • Activation requirements: MFA or authentication strength, justification, ticket number, approval
  • Notifications to other admins when sensitive roles are activated
  • Access reviews to confirm people still need their eligibility
  • PIM for groups, so access to groups that grant permissions can also be just-in-time

When it is worth it

SituationPIM value
One or two admins, small tenantHelpful but optional if other controls are strong
Several admins or an outsourced IT partnerHigh: removes standing access and records who did what
Regulated industry or cyber insurance questionnaireHigh: provides approval and audit evidence
Azure subscriptions with production workloadsHigh: covers Azure roles as well as Entra roles
Frequent role changes for projectsHigh: time-bound assignments expire on their own

Licensing

PIM is an Entra ID P2 feature and is also part of Entra ID Governance. Microsoft 365 Business Premium and Microsoft 365 E3 include Entra ID P1, so they do not include PIM. Microsoft 365 E5 includes P2.

Microsoft's licensing guidance is based on the users who benefit from PIM, such as eligible admins and approvers. Many small and mid-size businesses buy a small number of add-on licenses for their admin accounts rather than upgrading everyone. Confirm current licensing terms with your reseller.

A sensible PIM setup

  • Create separate cloud-only admin accounts, not mail-enabled daily accounts, for anyone with admin rights.
  • Convert permanent role assignments to eligible, except for two break-glass accounts that are excluded and monitored.
  • Use the least-privileged role that fits the task, such as User Administrator or Exchange Administrator rather than Global Administrator.
  • Set activation to require phishing-resistant MFA, a justification and, for Global Administrator and Privileged Role Administrator, approval.
  • Keep activation windows short, typically a few hours.
  • Send activation alerts to a monitored mailbox and review the PIM audit history.
  • Run quarterly access reviews on eligible assignments.

If you cannot use PIM yet

You can still reduce admin risk without P2. Use separate admin accounts, limit Global Administrator holders, assign narrower roles, require phishing-resistant MFA and compliant devices for admin roles in Conditional Access, block legacy authentication, and review role membership monthly. These controls are worth doing even after PIM is in place.

How Accred Consulting approaches it

Accred Consulting starts by reviewing who holds which roles today, how admin accounts are used, and what licensing you have. The proposal sets the target role model, the PIM policy settings, any license additions, a fixed price and a timeline. Our US-based specialists create separate admin accounts, convert standing assignments to eligible, configure activation rules, approvals and alerts, and protect break-glass accounts. At handover you get a role matrix, the activation guide for admins and an access review schedule, with optional support to run reviews.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

A little. Activating a role takes a minute or two, longer if approval is required. Most teams accept that trade for removing standing admin rights. Keep approval for the most sensitive roles only, so routine tasks like password resets are not held up.
Yes, if they work in your tenant. Their accounts, or their delegated access through GDAP, should have the least privilege needed, time limits and logging. PIM for groups can make partner access just-in-time as well.
No. Break-glass accounts should hold Global Administrator permanently so you can recover if PIM, MFA or Conditional Access fails. Protect them with strong credentials such as FIDO2 keys kept securely, exclude them from most policies, and alert on any sign-in.
Keep it small: usually two to four named people with eligible assignments, plus two break-glass accounts. Most daily admin work fits narrower roles such as User Administrator, Exchange Administrator, Intune Administrator or Helpdesk Administrator. Microsoft Secure Score and Entra recommendations flag tenants with too many Global Administrators.

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.

Book a free consultation