Privileged Identity Management (PIM)
A Microsoft Entra service that grants elevated admin access just-in-time and for a limited window, instead of leaving privileged roles active permanently.
Standing admin access — an account that’s permanently a Global Administrator, for example — is a real risk: if that account is ever compromised, the attacker gets everything, all the time. Privileged Identity Management (PIM) removes that standing access and replaces it with time-limited activation: an admin requests the role when they actually need it, it’s approved (automatically or by a reviewer), and it expires on its own after a set window.
PIM also gives you an audit trail of exactly who activated which privileged role, when, and why — something a permanently-assigned role can’t offer.
It pairs naturally with Conditional Access and Role-Based Access Control: RBAC defines the roles, PIM controls when they’re actually active, and Conditional Access governs the conditions under which activation is even allowed.