Field Notes · Sheet 12 / 30 · Privileged access
Anatomy of a PIM activation
The six steps behind one PIM activation in Entra ID, from eligible to active and back, and two settings to choose with care: the window and the alerts.
Bradley Baker · · 1 min read
Activating a privileged role in Entra PIM looks like one button. Six things happen behind it. This is the longer version of Sheet 12.
Six steps
- The eligible assignment sits there granting nothing.
- The admin requests activation for a window up to the role's maximum, anywhere from 1 to 24 hours depending on how you configured it.
- Entra checks the activation requirements: MFA or an authentication context, a justification, a ticket number.
- If the role requires approval, the request waits for an approver.
- The role goes active for the requested window.
- The window ends and PIM removes the active assignment. The eligible assignment stays as long as it's valid, and the activation stays in the audit history for 30 days.
Sheet 11 covers how those requirements differed for internal admins, consultants, and vendors in one tenant.
Two design choices
Size the window to the work
Size the maximum window to the work, not to the worst case. A 24-hour window on Global Administrator is standing access with extra steps.
Route the alerts
Send notifications somewhere a person actually reads. PIM lets you route activation alerts to specific addresses, so pick ones someone watches.
What's your maximum activation window for Global Administrator?
Sources
- Configure Microsoft Entra role settings in Privileged Identity Managementlearn.microsoft.com
From the field reports
- Azure PIM
- Entra ID
- Activation
- Approval
- Notifications