Privileged Identity Management (PIM) is the single most impactful control an Australian organisation can deploy in Microsoft Entra ID. As Microsoft Learn describes it: "Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about." (learn.microsoft.com — pim-configure, accessed 23 May 2026). The 2026 update is significant: PIM for Groups went generally available across all Entra ID P2 SKUs, which closes a long-standing delegation gap for SharePoint, Exchange, and SOC team scenarios.
This is one of four operational spokes off Auditing Entra ID for the Australian Privacy Act. It is paired with the free Entra ID & Identity Assessment which measures PIM coverage as part of Pillar 1.
Phase 1 — Discovery
Before configuring PIM, inventory the existing privilege surface. Run these queries in the Entra admin centre or via Microsoft Graph:
- List every account with a directory role assignment (Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Exchange Administrator, SharePoint Administrator, Conditional Access Administrator, Security Administrator, User Administrator, Authentication Administrator).
- List every owner of every Microsoft 365 group used for SharePoint or Teams administration.
- List every service principal with application-level Graph permissions.
In a typical mid-market Australian tenant we discover three times more privileged accounts than the customer thinks exist. Document the gap before you start changing anything.
Phase 2 — Role design
Decide which roles will be eligible-only (PIM-managed) versus active. Microsoft's recommendation, and the ASD ISM expectation, is that every privileged role except break-glass is eligible-only.
Role-design table to fill in:
- Global Administrator: target three or fewer eligible assignments, zero standing.
- Privileged Role Administrator: target two eligible assignments.
- Exchange Administrator, SharePoint Administrator: target two to four eligible assignments.
- Conditional Access Administrator: same individuals as Global Admins, scoped role.
- Security Administrator: scoped to SOC team.
For SharePoint and Teams, design custom roles using PIM for Groups so site collection admins are time-bound without escalating them to tenant-level Exchange or SharePoint administrator roles.
Phase 3 — Eligibility and activation settings
For each role, configure:
- Maximum activation duration. 4 hours for Global Admin and Privileged Role Admin; 8 hours for the rest.
- Require justification on activation. Always on. Justification text is logged.
- Require ticket on activation. Optional — switch on if you have an integrated ITSM (ServiceNow, Jira Service Management).
- Require approval. Always on for Global Admin and Privileged Role Admin. Optional for the rest.
- Require Conditional Access authentication context. Pair PIM activation with a Conditional Access policy that demands sign-in frequency 4 hours and compliant device. Activations are now also gated by device posture.
- Notification recipients. SOC distribution list plus the role owner.
Phase 4 — Approval workflows
For Global Administrator and Privileged Role Administrator activations, require approval. Approvers should be:
- A different individual from the requester (no self-approval).
- At least two named approvers per role (so leave does not block).
- The CISO or equivalent for any sustained activation beyond a single change window.
Approval records are retained in the Entra audit log and become evidence for any future OAIC enquiry.
Phase 5 — Break-glass design
Break-glass accounts are the safety net. They MUST be excluded from PIM (they need to be permanently active so they work during an identity outage). Microsoft's guidance: at least two cloud-only accounts, randomly generated 64+ character passwords stored in a hardware safe, excluded from all Conditional Access policies except the block-legacy-auth policy, monitored with alerts on every sign-in.
ASD ISM-1175 expects:
- Hardware-stored credentials.
- Continuous monitoring.
- Quarterly test sign-in by the CISO or delegate.
- Documented procedure for use.
Test the accounts quarterly. We have seen Australian tenants where the break-glass accounts had silently expired because someone removed them from a CA exclusion months earlier.
Phase 6 — PIM for Groups (the 2026 unlock)
PIM for Groups is the most underused 2026 feature. Use it for:
- SharePoint site collection administration delegated to a business unit lead.
- Teams owner permissions for sensitive Teams.
- Custom application roles where the application accepts a group membership claim.
Configuration is identical to role PIM — set maximum activation, require justification, optionally require approval.
Phase 7 — Access reviews on PIM assignments
Schedule an automated access review every quarter on every PIM-eligible assignment. The Entra ID access reviews feature with ML reviewer recommendations (GA February 2026) suggests which assignments to remove based on activation history. Acting on those recommendations satisfies the access-review element of ISM-1175.
Common pitfalls
- Self-approval. If you let admins approve their own activations the audit trail is worthless. Always require a separate approver.
- Excluding too much from Conditional Access. Some teams exclude every privileged user from MFA "for convenience". PIM activations should fire MFA every time; never exclude PIM-managed accounts from MFA.
- Forgetting service principals. Application identities (service principals) hold privilege too. PIM cannot manage them directly — use Conditional Access for workload identities (Entra Workload ID licensing) instead.
Bottom line
A defensible PIM rollout takes four to six weeks for a mid-market Australian tenant. Discovery first, then role design, then eligibility, then approvals, then break-glass, then PIM for Groups. The free Entra ID & Identity Assessment gives you a before-and-after score, and the practitioner Identity and Access Review inspects PIM configuration against ASD ISM-1175 in detail.
Sources: Microsoft Learn — Privileged Identity Management configuration and PIM for Groups (accessed 23 May 2026). ASD Information Security Manual November 2025 release — ISM-1175 Privileged Access Management and ISM-1647 Time-Bound Privileged Access (cyber.gov.au, accessed 23 May 2026). ASD Restrict Administrative Privileges (Essential Eight) guidance (cyber.gov.au, accessed 23 May 2026).
