3.4.3. Privileged Identity Management (PIM)

💡 First Principle: PIM applies least-privilege and just-in-time principles specifically to privileged roles — instead of a user holding an admin role permanently ("standing access"), PIM makes the role "eligible," and the user activates it only when needed, for a limited, time-bound window, after which the elevated access automatically expires.

This directly implements Zero Trust's least-privilege principle from Phase 2.1.3: a user isn't a standing admin every hour of every day, minimizing the window during which a compromised account could exploit that privilege. Activation typically requires MFA re-verification, a business justification, and sometimes approval from another admin — all logged for audit.

⚠️ Exam Trap: PIM does not permanently remove a role from a user — it converts standing (always-on) assignment into eligible (activate-when-needed) assignment. The user still holds eligibility continuously; they just aren't actively privileged every moment.

Reflection Question: Why does converting an admin role from "always active" to "eligible, activate when needed" reduce the impact of a compromised admin account, even if the account's credentials are identical either way?