1.2MS-102Advanced

Est: ~15 mins•Verified: 2026-08

Privileged Identity Management (PIM) & JIT Access

Implement Just-in-Time (JIT) role activation, approval workflows, ticket enforcement, and automated Access Reviews using Microsoft Entra PIM.

Tags:#PIM#Entra ID#Zero Standing Access#JIT#Security#MS-102

Overview

Microsoft Entra Privileged Identity Management (PIM) enforces the Zero Trust principle of Zero Standing Access (ZSA) across Microsoft 365 and Azure resources. Instead of assigning permanent, standing administrative privileges (such as Global Administrator, Exchange Administrator, or Security Administrator), administrators are granted Eligible role assignments.

When elevated privileges are required:

The user requests Just-in-Time (JIT) activation for a maximum duration (e.g., 4 to 8 hours).
The user is required to authenticate with Phishing-Resistant MFA.
The request mandates entering a justification and incident/ticket number (e.g., ServiceNow INC#).
For highly sensitive roles (Global Admin), the activation requires multi-person authorization from designated approvers.
Once the duration expires, elevated privileges are automatically revoked.

---

When to Use

Role Assignment Type	Target Audience	Risk Posture
Eligible Assignment (Recommended)	Human IT Administrators (Tier 0 / Tier 1)	High security; privileges are dormant until activated with MFA and approval.
Active Assignment (Time-bound)	Contractors / Vendors for short projects	Automatically revokes on an expiration date (e.g., after 30 days).
Permanent Active (Emergency Break-Glass)	2 Cloud-only Emergency Glass Accounts	Excluded from PIM, Conditional Access, and MFA hardware tokens.

---

Prerequisites

Licensing & Permissions:

Microsoft Entra ID P2 or Microsoft 365 E5.
Privileged Role Administrator or Global Administrator to configure PIM policies.

---

Portal Path

TEXT

Microsoft Entra Admin Center (https://entra.microsoft.com)
└── Identity governance
    └── Privileged Identity Management
        ├── Microsoft Entra roles
        │   ├── Roles (Inspect, configure settings & assignment rules)
        │   ├── Assignments (Eligible & Active assignments)
        │   └── Alerts (Unassigned elevation, frequent activation)
        └── Access reviews (Automate periodic quarterly re-certification)

---

Step-by-Step Implementation

Step 1: Configure Role Activation Settings

Navigate to Entra Admin Center > Identity governance > Privileged Identity Management > Microsoft Entra roles > Roles.
Select target role: Global Administrator.
Click Role settings in the top action bar > Click Edit.
Configure Activation rules:

Activation maximum duration (hours): 4
On activation, require: Azure MFA
Require justification on activation: Yes
Require ticket information on activation: Yes
Require approval to activate: Yes > Select designated approvers (e.g., CISO or Head of IT Infrastructure).

Configure Assignment rules:

Allow permanent eligible assignment: Yes
Allow permanent active assignment: No (Enforces Zero Standing Privilege).

Configure Notification settings: Send critical activation alerts to the Security Operations Center (SOC).

Step 2: Assign an Eligible Role to an Administrator

In PIM > Microsoft Entra roles > Assignments > Click Add assignments.
Select role: Global Administrator.
Select members: Select user admin.sarah@contoso.com.
Setting: Eligible | Assignment type: Permanently eligible.
Click Assign.

Step 3: Activating the Role (User Experience)

The administrator signs in to Entra portal > My roles > Microsoft Entra roles.
Click Activate next to Global Administrator.
Complete MFA challenge > Enter Reason: "Routine Exchange migration troubleshooting" > Enter Ticket: INC-49201.
Approver receives email notification, reviews justification, and clicks Approve.

---

PowerShell Automation

Check Active and Eligible PIM Assignments via Graph:

PowerShell

Connect-MgGraph -Scopes "RoleEligibilitySchedule.Read.Directory", "RoleAssignmentSchedule.Read.Directory"

# List all Eligible role assignments in tenant
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -All | 
    Select-Object roleDefinitionId, principalId, startDateTime, endDateTime

# List all actively elevated PIM assignments
Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -Filter "assignmentType eq 'Activated'" |
    Select-Object roleDefinitionId, principalId, startDateTime, endDateTime

---

Microsoft Graph Automation

Create an Access Review for Privileged Roles:

PowerShell

Connect-MgGraph -Scopes "AccessReview.ReadWrite.All"

$ReviewBody = @{
    displayName = "Quarterly Global Admin Access Review"
    description = "Validate that all users with Global Admin eligibility still require access."
    scope = @{
        "@odata.type" = "#microsoft.graph.accessReviewQueryScope"
        query = "/roleManagement/directory/roleDefinitions/62e90394-69f5-4237-9190-012177145e10/transitiveAssignments"
    }
    reviewers = @(
        @{
            query = "/users/ciso@contoso.com"
        }
    )
    settings = @{
        mailNotificationsEnabled = $true
        reminderNotificationsEnabled = $true
        recurrence = @{
            pattern = @{
                type = "absoluteMonthly"
                interval = 3
            }
        }
    }
}

New-MgIdentityGovernanceAccessReviewDefinition -BodyParameter $ReviewBody

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Administrators have 0 permanent standing assignments for Global Administrator.

Activating the role forces an MFA verification challenge.

Attempting to activate without entering a ticket number blocks submission.

Approver receives immediate email and push notification in Authenticator app.

Role privileges automatically drop after 4 hours without manual intervention.

Diagnostic Logs & Channels

Channel / Tool	Log Location	Purpose
PIM Resource Audit	PIM > Microsoft Entra roles > Resource audit	Records every role activation request, justification, approver action, and expiration.
Entra ID Audit Logs	Entra Admin Center > Monitoring > Audit logs	Filter by Service: `Privileged Identity Management` to capture role elevation events in SIEM.
PIM Security Alerts	PIM > Microsoft Entra roles > Alerts	Flags anomalous admin activity (e.g., roles activated too frequently, accounts not using roles).

---

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
"Activation requires MFA but user cannot complete"	User has not registered required strong authentication method (FIDO2/Authenticator).	User must register MFA methods via `aka.ms/mfasetup` before requesting PIM activation.
Approver did not receive approval request	Approver email address is invalid, or notification was swallowed by junk filter.	Navigate to PIM > Approve requests to approve directly in the portal without email.
PIM settings grayed out	User lacks Privileged Role Administrator role or tenant Entra ID P2 license expired.	Verify active Entra ID P2 licensing and grant user Privileged Role Administrator role.

---

Production Best Practices

Production Best Practice

Exclude Break-Glass Accounts from PIM:

Do NOT configure your 2 emergency break-glass accounts as PIM Eligible. If Microsoft Entra PIM experiences a cloud service degradation, you must have permanent access to break-glass accounts stored in a physical fireproof safe.

---

MS-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

PIM Scope: PIM manages both Microsoft Entra roles (tenant-wide) and Azure resources (subscriptions/management groups).
Eligible vs Active: Eligible requires user action to activate; Active is already active without user initiation.
Access Reviews Auto-Apply: If a reviewer does not respond, Access Reviews can be configured to automatically Remove access or Take recommendations.

---

Official Documentation

PREVIOUS TOPIC1.1 Custom Domain Setup & Service Health Monitoring NEXT TOPIC1.3 Administrative Units (AU) & Cross-Tenant Access Settings