Privileged Identity Management (PIM)

What it is

An administrator account that holds its powers all day, every day, is a standing risk: if it is phished, the attacker gets those powers too. PIM reduces that risk by making admin roles something you switch on when needed rather than something you always have.

Microsoft lists PIM’s main features as:

• Just-in-time access to admin roles
• Time-bound assignments with start and end dates
• Approval before a role can be activated
• MFA required to activate any role
• A written justification for each activation
• Notifications when privileged roles are activated
• Access reviews to check people still need their roles
• Audit history you can download for an internal or external audit

The key idea is the difference between an eligible assignment and an active one. An eligible user doesn’t hold the role until they activate it, for a limited period. An active user holds it all the time. The access granted is the same, the difference is that nobody carries it around when they don’t need it.

Why it matters for a UK small or regulated business

In a small firm the person with Global Administrator rights is often also the person reading email and approving invoices all day. PIM, or at least separate admin accounts, keeps those powers out of everyday use. The audit trail is also useful evidence when a regulator, insurer or ISO 27001 auditor asks who can change your systems and how you control it.

How it works in Microsoft 365

PIM needs Microsoft Entra ID P2 or Microsoft Entra ID Governance licences. Microsoft 365 Business Premium includes Entra ID P1, not P2, so most small businesses would need an add-on. Where PIM isn’t licensed, the same principle still applies: keep Global Administrators to a small number, give admins separate accounts, use the least powerful role that does the job, and protect admin sign-in with phishing-resistant MFA. Emergency break-glass accounts should stay permanently active rather than eligible.

How &DEV helps: our cyber assurance uplift for regulated firms tightens admin access, with PIM where your licences include it, and documents who holds which role.