Definition
Privileged Identity Management (PIM) reduces standing privileges by supporting time-limited activation of sensitive roles.
How it works
In Microsoft Entra, eligible roles may require MFA, justification, approval and an activation duration. Eligibility is not the same as permanently active access; activation logs provide audit evidence.
Real-world example
An operator activates the Exchange Administrator role for a scheduled change and loses elevated access automatically after expiry.
Limits and best practices
Reduce permanent privileged assignments, protect emergency accounts, review eligibility and test approval workflows.