Entra PIM baseline: roles, approvals, alerts and audit

Learn says you need Microsoft Entra ID Governance or Microsoft Entra ID P2 licences to use PIM and all of its settings. Check that everyone in the groups Learn lists is covered: eligible and time-bound users, approvers, and access review assignees and reviewers. Note the Azure mobile app option: Learn says it needs a P2 or EMS E5 licence for the signed-in user.

Learn recommends two cloud-only emergency access accounts permanently assigned Global Administrator. These are the one exception to zero permanently active assignments.

Learn also describes two safeguards. You cannot remove the last active Global Administrator assignment. A time-bound last-remaining Global Administrator assignment, active or eligible, is not removed at expiry. Treat these as a safety net and not as a plan.

Learn’s rollout guidance: put Global Administrator and Security Administrator under PIM first, because they can do the most harm if compromised. It also says to use the Privileged label to find the other high-privilege roles.

1. Sign in to the Microsoft Entra admin center as at least Privileged Role Administrator.
2. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, then Add assignments.
3. Choose Eligible or Active, and a permanent or time-bound duration.

Things Learn flags:

• PIM supports built-in and custom roles.
• An assignment cannot last less than five minutes and cannot be removed within five minutes of being assigned.
• Assigning a built-in Entra role to a guest user elevates the guest to the same permissions as a member user.
• Groups and agent identities can also be assigned through PIM.

Role settings are per role, and Learn says they are also called PIM policies.

1. As at least Privileged Role Administrator, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles.
2. Select the role, then Role settings, then Edit.
3. Set the activation maximum duration (1 to 24 hours), whether MFA is required on activation, and whether approval is required.
4. Select Update.

The ticket information field is informational only. Learn says correlation with any ticketing system is not enforced, so do not treat it as a control.

Learn also says PIM cannot enforce MFA when a user uses an active assignment, because they are active from the moment it is assigned. MFA can only be enforced when the assignment is created. That is another reason to keep standing active assignments to a minimum.

In the same role settings, require approval and choose specific approvers.

• Approvers do not need a role for Entra roles.
• Select at least one approver. Learn recommends at least two.
• If you select none, Learn says active Privileged Role Administrators or Global Administrators become the default approvers. That is how the lockout condition arises when everyone is only eligible.
• Approvers cannot approve their own requests, and service principals cannot approve.
• The first approver to respond resolves the request.
• Approvers act at ID Governance > Privileged Identity Management > Approve requests.
• Learn says multi-step approvals are not supported in the Graph approval API for Entra roles, and extend and renew requests cannot be approved through the Graph API.
• Learn says extend and renew requests need approval from a Global Administrator or Privileged Role Administrator.

Learn says the MFA requirement on activation may not prompt if the user already did MFA in the session or used strong credentials. To force fresh authentication, Learn points to the Conditional Access authentication context setting with authentication strengths.

Check the preview status in the verify callout first. If you go ahead, Learn’s order and rules are:

1. Create and enable the Conditional Access policy for the authentication context before configuring it in PIM.
2. For reauthentication on every activation, the policy must use sign-in frequency Every time. Learn says a 10-minute window then applies after a user reauthenticates, across Entra roles, Azure resource roles and PIM for Groups.
3. The MFA fallback applies only if no Conditional Access policy targets the context. Learn says it is not triggered if the policy is off, in report-only mode, or excludes the eligible user.
4. Do not scope one policy to both the authentication context and a directory role. Learn says activation-time requirements will not stop use of the role from another device afterwards, so use a second policy that targets directory roles.

For Entra roles, Learn says only Global Administrator, Privileged Role Administrator, Global Reader, Security Administrator and Security Reader can read PIM security alerts. To customise them, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts > Setting as at least Privileged Role Administrator.

Worth knowing:

• The High-severity alert “Roles are being assigned outside of Privileged Identity Management” can be enabled or disabled, with its email notification. Learn says such assignments are not properly monitored and might indicate an active attack. Leave it on unless you have a reason.
• The Low-severity alert “Roles don’t require multifactor authentication for activation” has an in-portal mitigation that makes MFA required for activation of the role.
• Learn gives these threshold ranges: “Administrators aren’t using their privileged roles” 0 to 100 days; stale accounts 1 to 365 days; “too many Global Administrators” a minimum count of 2 to 100 plus a percentage; “activated too frequently” 2 to 100 activations within a set timeframe.
• The “too many Global Administrators” alert fires only when both the count and the percentage are met.

For Azure resources, go to ID Governance > Privileged Identity Management > Azure resources, select the subscription, then Alerts > Setting, signed in as at least Privileged Role Administrator. Learn lists “Too many owners assigned to a resource” (Medium), “Too many permanent owners assigned to a resource” (Medium), “Duplicate role created” (Medium) and “Roles are being assigned outside of Privileged Identity Management” (High).

Learn says the Azure “assigned outside of PIM” alert fires only for role assignments at subscription scope. It is not triggered for management groups, resource groups or resources. Do not treat it as full coverage.

Learn says settings are per role and per resource, and are not inherited. Settings on a subscription do not carry down to a resource group.

1. Go to ID Governance > Privileged Identity Management > Azure resources.
2. Select the resource, then Settings.
3. Set each role you care about.

You need Owner or User Access Administrator to manage these settings. Unlike Entra roles, Learn says Azure resource roles have no default approvers, so name them.

Learn says settings are defined per role (Member or Owner) per group, and are independent of each other.

1. Go to ID Governance > Privileged Identity Management > Groups and select the group.
2. Select Settings, then Member or Owner, then Edit, then Update.

Learn’s points for groups:

• Approvers need not be members or owners. At least one is required, two are recommended, and there are no default approvers.
• Activation maximum duration is 1 to 24 hours, as for Entra roles.
• Do not scope one Conditional Access policy to both the authentication context and the group. Learn says that during activation the user has no group membership yet, so the policy would not apply.
• PIM does not support groups in Restricted Management Administrative Units.
• Group admins and owners can also change groups through the Groups experience. Learn says this overrides changes made in PIM.

Learn says the sender is MSSecurity-noreply@microsoft.com (display name Microsoft Security), with a “PIM” subject prefix. It says azure-noreply@microsoft.com is deprecated, so update mail rules to allow the new sender.

Notification settings are on the Notifications tab of role settings, with an option for critical emails only. Learn caps notifications at 1000 recipients per event.

Know who gets what:

• Azure resource roles: permanent Owners, eligible Owners and User Access Administrators.
• PIM for Groups: approval and assignment emails go to permanent Owners only, not eligible owners.
• The weekly Entra roles digest goes to Privileged Role Administrators, Security Administrators and Global Administrators who have enabled PIM. Learn says it is available for public cloud only.

Approval emails can lag. Learn says 90% take 3 to 10 minutes, and up to 15 minutes for some. If a request is approved in the portal before the first email is sent, that email is not sent to other approvers. Learn says that is expected.

With a test account that is eligible:

1. Go to ID Governance > Privileged Identity Management > My roles > Microsoft Entra roles and select Activate.
2. Complete any verification, optionally narrow the scope or set a custom start time, and give a reason.
3. If approval is required, the request shows as pending. Pending requests can be viewed and cancelled under My requests. After cancelling, the user must submit a new request.

Learn says activation adds the active assignment within seconds, but applications may cache role state, so users may need to sign out and back in. It also says a role cannot be deactivated within five minutes of activation.

To view PIM audit history, sign in as Global Administrator, Global Reader, Privileged Role Administrator, Security Administrator or Security Reader. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Resource audit. My audit shows a user’s own activity.

Learn says the data covers the past 30 days. To keep it longer, use Azure Monitor Diagnostic Settings to route Entra logs to an Azure storage account or Log Analytics. Learn’s deployment plan suggests at least one administrator reads all audit events weekly and exports them monthly.

To correlate events for one activation, Learn says CorrelationId can differ across a scheduled or approval-gated activation. Use roleAssignmentRequestId from Additional details instead. Learn’s Log Analytics example filters AuditLogs with AdditionalDetails has roleAssignmentRequestId. Confirm the exact query shape against Learn and your workspace before saving it.