Privileged Identity Management (PIM) Setup Guide for Australian Organisations

Privileged Identity Management (PIM) can reduce standing administrative access in Microsoft Entra ID by replacing permanent role assignments with eligible, time-limited activations. This supports a broader privileged-access control set aligned with the ASD ISM and the ACSC Essential Eight. This guide walks through the complete setup sequence for Australian organisations, from licence validation through to break-glass design.

This post is a practitioner companion to Auditing Entra ID for the Australian Privacy Act, the pillar that frames identity governance in the Australian regulatory context. The free identity assessment measures PIM coverage as part of Pillar 1 — Privileged Access Governance.

Why Standing Admin Access Is a Critical Risk

Every account with a permanent Global Administrator, Privileged Role Administrator, or Exchange Administrator assignment is a target. If an attacker compromises that account — through phishing, credential stuffing, or session token theft — they immediately hold the highest available privilege in your environment. There is no time window in which to detect and respond before damage is done.

PIM changes that equation. With eligible-only assignments, the directory role is inactive until an activation succeeds. Configure MFA, justification and, for selected high-impact roles, independent approval. This reduces standing privilege, although the underlying account and any non-PIM permissions still require protection.

The current ASD ISM requires privileged-access requests to be validated (ISM-1507), access to be limited to what users need for their duties (ISM-1508), and privileged-access events to be centrally logged (ISM-1509). PIM can help implement and evidence those outcomes. ISM-1175 addresses preventing privileged user accounts from accessing internet, email and web services; it is not a just-in-time access requirement. The Essential Eight maturity model does not prescribe PIM, so organisations should map the complete design to the controls that apply to their environment.

Phase 1 — Licence Validation

Before touching any PIM configuration, confirm licence coverage.

PIM requires Entra ID P2 for every user who will be:

• Eligible for a PIM-managed role.
• An approver in a PIM approval workflow.
• A reviewer in a PIM access review.

PIM for Groups — the mechanism for delegating SharePoint, Teams, and application administration via group membership — also requires P2 for every group member.

How to check current P2 coverage:

In the Microsoft 365 admin centre, navigate to Billing → Licences and confirm your P2 or E5 seat count against your intended PIM-managed population. Alternatively:

Connect-MgGraph -Scopes "Directory.Read.All"
Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -like "*AAD_PREMIUM_P2*" -or $_.SkuPartNumber -like "*EMSPREMIUM*"} | Select-Object SkuPartNumber, ConsumedUnits, @{N="AvailableUnits";E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}

Confirm licence coverage for every intended managed user before deployment. A licensing gap creates an entitlement and compliance problem; it does not automatically convert an eligible assignment into an active one. Verify both assigned licences and effective role state during acceptance testing.

Phase 2 — Discovery: Enumerate the Privilege Surface

Before converting standing assignments to eligible, understand what you have. The actual set of privileged accounts can differ from the approved register, so discovery must precede configuration.

Run this Graph query to enumerate all current role holders:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory", "Directory.Read.All"
$roles = Get-MgDirectoryRole -All
foreach ($role in $roles) {
    $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
    foreach ($member in $members) {
        [PSCustomObject]@{
            RoleName    = $role.DisplayName
            MemberName  = $member.AdditionalProperties["displayName"]
            MemberType  = $member.AdditionalProperties["@odata.type"]
            MemberUPN   = $member.AdditionalProperties["userPrincipalName"]
        }
    }
} | Export-Csv ".\privilege-inventory.csv" -NoTypeInformation

Document every finding. Pay particular attention to:

1. Service accounts and service principals with directory roles — PIM cannot manage these; they need a separate workload identity strategy.
2. Accounts with Global Administrator that are not the designated break-glass or primary IT admin accounts.
3. Accounts with Privileged Role Administrator — this role can modify PIM itself and is frequently over-assigned.
4. Accounts with roles matching personal mailboxes — Exchange Administrator assigned to an individual's user account rather than a dedicated admin account.

Remediate obvious over-assignment before enabling PIM. Enabling PIM on an over-assigned environment just makes the mess time-limited rather than removing it.

Phase 3 — Configure Eligibility and Activation Settings

With discovery complete and over-assignment resolved, configure PIM for each role.

Navigate to Entra admin centre → Identity Governance → Privileged Identity Management → Microsoft Entra roles.

For Global Administrator:

• Activation maximum duration: 4 hours.
• Require justification on activation: Yes.
• Require ticket number on activation: Yes (if you have an ITSM).
• Require MFA on activation: Yes (always).
• Require approval: Yes.
• Notification: SOC email distribution list plus the Global Admin role owner.

For Privileged Role Administrator:

• Same settings as Global Administrator. This role can modify PIM configuration — it is effectively equivalent to Global Admin for identity governance purposes.

For Exchange Administrator, SharePoint Administrator, Teams Administrator:

• Activation maximum duration: 8 hours.
• Require justification: Yes.
• Require MFA: Yes.
• Require approval: Optional — many organisations configure notification-only for these roles and reserve mandatory approval for Global Admin.

For Security Administrator, Security Reader, Compliance Administrator:

• Activation maximum duration: 8 hours.
• Require justification: Yes.
• Require MFA: Yes.
• Require approval: No — these roles are used operationally by SOC and compliance staff.

Conditional Access authentication context:

Pair PIM activations with a Conditional Access policy using authentication context. Create an authentication context named "PIM Activation" and bind it to a policy requiring a compliant device and sign-in frequency of 4 hours. PIM activations are then gated by device posture, not just MFA.

Phase 4 — Approval Workflow Configuration

For Global Administrator and Privileged Role Administrator, approval is mandatory. Configure it properly.

Approval settings (for each role that requires approval):

• Select at least two named approvers per role. A single approver creates an operational bottleneck — if that person is unavailable, every activation blocks.
• Approvers must be different individuals from the people who will request activations. Self-approval is not an approval — it is an audit event with no governance value.
• Set an approval timeout of 2 hours. If no approver responds within 2 hours, the activation is denied. Do not set "auto-approve if no response" — this defeats the purpose of requiring approval.
• Notify all approvers on every request so the approval does not rely on a single person checking their email.

Who should be approvers?

For Global Administrator: the CISO or IT manager, plus a deputy. For privileged role administrators: the identity team lead plus the CISO.

Approval records are retained in the Entra audit log and in PIM's own activity report. These records are direct evidence for any OAIC privacy investigation or ACSC Essential Eight audit that questions how privileged access is governed.

Phase 5 — Break-Glass Account Design

Break-glass accounts are permanently active Global Administrators. They exist specifically to provide tenant access if normal authentication mechanisms — including PIM, Conditional Access, and MFA — fail or are misconfigured.

Recommended break-glass controls (aligned to the ASD ISM's privileged access guidance):

1. Minimum of two cloud-only break-glass accounts (not synced from on-premises AD).
2. Randomly generated passwords of 64 characters or more, stored in a hardware safe, not in a password manager accessible from the network.
3. Excluded from all Conditional Access policies (except the block-legacy-authentication policy).
4. Excluded from PIM (permanently active Global Administrator assignment).
5. Every sign-in to a break-glass account must generate an immediate alert — configure a Log Analytics alert rule or Microsoft Sentinel analytic rule for sign-ins from these specific UPNs.
6. Test access on a regular, documented cycle — the CISO or delegate attempts a sign-in and records the result.

Microsoft Learn states: "Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or 'break glass' scenarios where normal administrative accounts can't be used." (learn.microsoft.com — security-emergency-access, accessed 28 June 2026).

A break-glass account that has silently expired or been removed from a Conditional Access exclusion is one of the most dangerous misconfiguration patterns we encounter in Australian tenant reviews. It means the safety net is gone without anyone knowing.

Phase 6 — PIM for Groups

PIM for Groups extends just-in-time access to group-based delegated administration — the right mechanism for SharePoint site collection admins, Teams channel owners, and application-specific admin roles.

When to use PIM for Groups instead of direct role PIM:

• A business unit lead needs temporary SharePoint site collection administration for a migration project.
• A developer needs temporary application administrator permissions for a deployment window.
• SOC analysts need periodic access to an application admin role for an investigation.

Configuration mirrors direct role PIM — set maximum activation duration, require justification, optionally require approval. The key difference is that PIM for Groups does not require the group to be a privileged Entra ID role group — it works with any security group used for application or resource access.

Phase 7 — Access Reviews on PIM Assignments

Schedule quarterly access reviews on all PIM-eligible assignments. In Entra admin centre → Identity Governance → Access reviews → New access review:

• Scope: Users eligible for Entra ID roles (select all roles).
• Reviewers: Manager of each eligible user, falling back to selected reviewers if no manager is set.
• Frequency: Quarterly, 14-day review period.
• If reviewer does not respond: Remove access. This is the critical setting.
• Apply results automatically: Yes.

Access review reviewer recommendations highlight which eligible assignments have never been activated in the previous quarter — these are strong candidates for removal. Acting on the recommendations reduces the privilege surface while generating a documented decision record.

Common Pitfalls to Avoid

• Over-excluding from Conditional Access. Some teams exclude Global Admins from MFA-requiring CA policies "to avoid friction". PIM activations should trigger MFA every time. Never exempt PIM-managed accounts from MFA requirements.
• Forgetting service principals. App registrations and managed identities can hold powerful directory roles. PIM cannot manage them — use Entra Workload ID Conditional Access policies for application-level privilege governance.
• Single approver per role. Operational blockers erode trust in PIM and lead admins to work around it. Always configure at least two approvers.
• Skipping discovery. Enabling PIM on a high-assignment-count tenant without prior discovery means you are making permanent assignments eligible without understanding what those assignments were used for. Discovery-first is not optional.

Bottom Line

A complete PIM deployment covers discovery, licence validation, eligibility configuration, approval workflows, break-glass design, PIM for Groups and access reviews. Its schedule depends on tenant complexity, licensing, approver availability and change controls. The result can reduce standing privilege and produce evidence that supports an organisation's ISM and Essential Eight assessment, but PIM alone does not establish compliance.

The free identity assessment measures PIM coverage as Pillar 1 of the Entra ID posture score. For organisations that need a detailed configuration review against ASD ISM and Essential Eight requirements, the practitioner Identity and Access Review provides a fully documented report with gap analysis and remediation guidance.

Sources: Microsoft Learn — Privileged Identity Management configuration, PIM for Groups, emergency access accounts (learn.microsoft.com, accessed 28 June 2026). ASD Information Security Manual — privileged access management and time-bound privileged access guidance (cyber.gov.au, accessed 28 June 2026). ACSC Essential Eight Restrict Administrative Privileges — Maturity Levels guidance (cyber.gov.au, accessed 28 June 2026).