5.3.1. PIM for Microsoft Entra Roles
💡 First Principle: Each role carries its own risk, so PIM configures gates per role: what activation demands, how long it lasts, who approves, who's told. Role settings are policy; assignments are instances of it.
| Eligible assignment | Active assignment | |
|---|---|---|
| Grants | Right to activate | Live permissions now |
| Best for | Normal admin work | Break-glass, service needs, short exceptions |
| Duration options | Permanent eligible or time-bound eligible | Time-bound (or permanent, discouraged) |
| Exam smell | "Just-in-time," least privilege | "Standing access" — justify or eliminate |
Role settings (per role, e.g., stricter for Global Administrator than Groups Administrator): activation maximum duration (1–24 h), require MFA on activation (or an authentication context from 2.2.3 to demand phishing-resistant strength), require justification and/or ticket number, require approval with named approvers, and assignment rules (allow permanent eligible? expire active after N days?). Notifications alert on assignments and activations. The activation sequence:
Operational details with exam presence: activation may take a couple of minutes to propagate (sign-out/in refreshes tokens with the new role); roles can be activated in advance for scheduled work; PIM for Groups (5.3.2) extends the same machinery; and Microsoft's recommended architecture pairs PIM with role-assignable groups — assign the group the role, make membership PIM-governed.
⚠️ Exam Trap: Requiring approval for activation is a per-role setting, not tenant-wide — and approvers approve activations, not assignments (assignment approval is a separate concept). "Ensure a second person signs off every time Global Admin is used" = role setting: require approval to activate, with named approvers.
Reflection Question: Configure Global Administrator so activation needs phishing-resistant MFA, a ticket, sign-off, and dies within two hours — name each setting. Which one is enforced via a Conditional Access feature rather than PIM itself?
