2.1.1. Privileged Identity Management (PIM)
💡 First Principle: Standing privileged access is a standing liability — every minute an account holds admin rights it isn't actively using is a minute an attacker could steal and use those same rights. PIM converts privileged roles from "always on" to "on when justified, and only for as long as justified."
PIM works by separating eligible assignments from active ones. An eligible assignment means a user can activate the role — subject to whatever requirements you configure (MFA, justification, approval from a designated approver, a maximum activation duration) — but holds zero standing permissions until they do. Once activated, the assignment becomes active for a bounded window and then automatically expires back to eligible. This applies to both Azure roles (via Azure resource RBAC) and Microsoft Entra roles (like Global Administrator).
⚠️ Exam Trap: A user listed in a role's "Assignments" blade is not necessarily an active risk — check whether the assignment type is Eligible or Active before concluding they have standing access. Scenario questions frequently show an assignment list and ask you to identify who has actual current privileged access, which requires reading the assignment type, not just the name in the list.
Reflection Question: Two users both appear under the Global Administrator role. One has an Active assignment, the other Eligible. What's the practical difference in what each can do right now?
