Make admin roles eligible in PIM: no permanent active assignment except the two emergency accounts¶
Licence and role
PIM: Microsoft Entra ID P2 or Microsoft Entra ID Governance (P2 is in Microsoft 365 E5 and EMS E5). Without one of these licences PIM shows the alert 'The organization doesn't have Microsoft Entra ID P2 or Microsoft Entra ID Governance'.
Why it matters¶
A standing admin role is available to an attacker the moment the account is taken over. With Privileged Identity Management users are made eligible and activate the role for a limited time; access is removed automatically when the time ends. PIM can also require approval and send notifications when a role is activated.
Steps¶
- Confirm the licence (Entra ID P2 or ID Governance) for every person who will hold an eligible role, and confirm the two emergency access accounts exist and are excluded from Conditional Access (Conditional Access Baseline Kit CA01).
- Set the PIM role settings first (PA03), so the new eligible assignments are created under the right rules.
- In ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments, add each admin as Eligible for the roles agreed in PA01. Start with Global Administrator, Privileged Role Administrator and Privileged Authentication Administrator.
- Ask each admin to activate once and confirm it works, then remove their Active assignment for that role. Keep only the two emergency access accounts as permanent Active Global Administrators.
- Repeat for the other privileged roles, one role per day, and record each change in the tracker.
Impact on users¶
Admins must activate a role before using it (a few seconds without approval, longer with approval). Scripts or service accounts that relied on a user holding a standing role stop working: list them before you start and move them to an app identity with the least permission.
Rollback¶
Re-add the Active assignment for the person and role in PIM > Assignments > Add assignments > Active. Leave the eligible assignment in place so you can try again.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.Governance, .Users, .DirectoryObjects, .Authentication).
Connect first:
Connect-MgGraph -Scopes RoleManagement.Read.Directory,RoleManagementPolicy.Read.Directory,AccessReview.Read.All,User.Read.All,Directory.Read.All
Role: Global Reader is normally enough. If a PIM read is denied, run it as Privileged Role Administrator: the script still only reads.
$rd = @{}
Get-MgRoleManagementDirectoryRoleDefinition -All | ForEach-Object { $rd[$_.Id] = $_.DisplayName }
$i = @(Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All)
"Active role assignments: $($i.Count) | activated through PIM right now: $(@($i | Where-Object { $_.AssignmentType -eq 'Activated' }).Count) | permanent (no end date): $(@($i | Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime }).Count)"
$i | Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime } | Select-Object -First 60 | ForEach-Object { $o = Get-MgDirectoryObject -DirectoryObjectId $_.PrincipalId -ErrorAction SilentlyContinue; $name = if ($o.AdditionalProperties['userPrincipalName']) { $o.AdditionalProperties['userPrincipalName'] } else { "$($o.AdditionalProperties['displayName']) ($($_.PrincipalId))" }; " permanent: $name | $($rd[$_.RoleDefinitionId])" }
How to verify¶
PA02 lists permanent active assignments only for the two emergency access accounts (and for service principals you have reviewed). Each admin has activated at least once from PIM.
Sources¶
- Best practices (Microsoft Learn)
- Tutorial PIM (Microsoft Learn)
- Security emergency access (Microsoft Learn)
This control is in the Privileged Access and PIM Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script.