Privileged access and PIM controls

Fewer standing admins: eligible roles in PIM, strict Tier 0 settings and quarterly reviews.

ID	Control	Priority	Effort
PA01	Inventory every privileged role assignment and bring Global Administrators below five	Highest	3 h
PA02	Make admin roles eligible in PIM: no permanent active assignment except the two emergency accounts	Highest	4 h
PA03	Set PIM role settings for Tier 0 roles: short activation, MFA or authentication context, justification, approval by two people	Highest	2 h
PA04	Give every admin a separate cloud-only admin account, not synced from on-premises	High	3 h
PA05	Run a quarterly access review of privileged roles and alert on roles assigned outside PIM	High	2 h

These are the free Top 5. The Privileged Access and PIM Kit has all 5 controls, with the Jira import, Excel plan and read-only script.