Zero standing privilege for three kinds of admin

Consultants, vendors, and internal admins all needed privileged roles in the same 4,300-user tenant. None of them held those roles standing. This is the longer version of Sheet 11: how Azure PIM made that work, and how the settings differed by group.

Eligible, not active

I administered Azure PIM for just-in-time, zero standing privilege access across all three groups. Everyone was eligible for the roles they needed. Nobody was active until they asked.

Eligible means the assignment exists but grants nothing until the person activates it. Each role's activation can require its own conditions:

• MFA on activation, or a Conditional Access authentication context when you need something stronger.
• A justification, a ticket number, or both.
• Approval from a named approver.
• An activation window you set anywhere from 1 to 24 hours.
• Eligible assignments that expire, so a contract end date is also an access end date.

Settings by relationship

The three groups didn't get identical settings. The less continuous the relationship, the shorter the window and the more likely an approval sat in front of it.

The audit trail

The audit trail matters as much as the access control. Every activation records who, which role, when, and the justification they gave. PIM keeps that history for 30 days, so export it if your audits need more. The field report covers the engagement this note comes from.

If you checked right now, how many permanent Global Administrator assignments would you find?