Standing admin rights are a gift to attackers. An account that is Global Administrator around the clock is just as powerful at 3 a.m. on a Sunday as it is during a planned change. Privileged Identity Management, the just-in-time admin feature in Microsoft Entra ID, fixes that by making admin roles something you switch on for an hour when you need them, rather than something you carry all the time.
Small IT teams often assume PIM is an enterprise tool with enterprise overhead. It does not have to be. Here is a setup that works for a team of one to five people without slowing anyone down.
What Privileged Identity Management actually does
PIM changes how admin roles are assigned. Instead of a permanent assignment, an admin gets an eligible assignment. The role does nothing until the admin activates it, which can require MFA, a reason, a ticket number or approval from someone else. When the activation window ends, the role switches itself off.
The key features for a small business are:
Just-in-time activation of Microsoft Entra roles, such as Global Administrator or Exchange Administrator.
Time-bound assignments with start and end dates, useful for contractors.
MFA, justification or approval required at activation.
Email notifications whenever a privileged role is activated.
Access reviews to confirm people still need their roles.
An audit history you can hand to an auditor or insurer.
PIM also covers Azure resource roles and groups through PIM for Groups, but most small businesses get the biggest win from Entra roles first.
Licensing: what you need before you start
PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. This is where many small businesses stop, because Microsoft 365 Business Premium includes Entra ID P1, not P2.
Your options:
Microsoft 365 E5 includes Entra ID P2.
Entra ID P2 can be bought as a standalone add-on.
Microsoft Entra Suite and Entra ID Governance also qualify.
Microsoft’s licensing guidance says the license is needed for users with eligible or time-bound assignments, users who approve activations, and users who perform access reviews. For a small team, that usually means licensing only your handful of admins, not the whole company. That makes PIM far more affordable than people expect.
If P2 is genuinely out of reach, the fallback is separate cloud-only admin accounts, phishing-resistant MFA for admins and a quarterly review of role assignments. It is not as strong, but it closes most of the gap.
A lightweight PIM setup for small teams
This configuration balances security with the reality that the same two people do everything.
Confirm your emergency access accounts exist. These two cloud-only accounts keep a permanent active Global Administrator assignment and are never made eligible. They are your way back in if PIM settings ever lock you out.
Open PIM. In the Microsoft Entra admin center, go to ID Governance > Privileged Identity Management > Microsoft Entra roles.
Review current assignments. Under Assignments, look at every active role. These are your standing admins today.
Configure role settings for Global Administrator, Privileged Role Administrator, Exchange Administrator, SharePoint Administrator and Security Administrator, using the table below.
Convert active assignments to eligible for your named admin accounts. Do this one admin at a time, and have each admin test an activation before you move on.
Turn on notifications so that every Global Administrator activation emails the other admins and the business owner.
Schedule an access review for privileged roles every quarter.
Suggested role settings
Setting
Global Administrator
Other admin roles
Activation maximum duration
2 to 4 hours
4 to 8 hours
On activation, require
Phishing-resistant MFA (via authentication context) or Entra MFA
Entra MFA
Require justification
Yes
Yes
Require approval
Yes, with at least two named approvers
No, for a small team
Eligible assignment expiry
Permanent eligible for staff, time-bound for contractors
Same
Active assignment
None, except emergency accounts
None
Avoiding the classic PIM lockout
Microsoft documents one scenario that will lock you out of your own tenant. It happens when all three of these are true at once:
Every Global Administrator and Privileged Role Administrator is eligible, and none are active.
Activation of those roles requires approval.
No approvers are configured, or the approvers have left.
Nobody can approve, so nobody can activate. The fix is simple: keep permanent active Global Administrator on your two emergency access accounts, and name at least two specific approvers. Review the approver list whenever someone leaves.
It is also worth knowing what happens if your P2 licenses lapse. Microsoft states that eligible assignments to Entra roles are removed, while permanent assignments are unaffected. In other words, admins who relied on activation lose their roles. Keep renewals on someone’s calendar and keep the emergency accounts in place.
Day-to-day use: what admins actually do
Once it is set up, an admin’s routine changes very little.
Sign in with the admin account and go to https://aka.ms/pim, which opens My roles.
Select Activate next to the eligible role.
Complete MFA, enter a short reason such as “Add shared mailbox for accounts team”, and set the duration.
Wait for approval if the role requires it. For other roles, it is active within a minute or two. Sign out and back in to the admin portal if the new permissions do not show straight away.
Do the work, then deactivate early if you finish before the window closes.
In the tenants I support, admins usually stop noticing the extra step within a couple of weeks. The owner, on the other hand, starts noticing the activation emails and gets a much clearer picture of who is changing what.
Getting more value from PIM over time
Once the basics are running, a few additions are worth the effort:
PIM for Groups: make membership of a privileged group eligible, so access to sensitive SharePoint sites or Azure subscriptions is also just-in-time.
Authentication context: link role activation to a Conditional Access policy that requires a passkey or FIDO2 key and a compliant device.
Azure resource roles: make Owner and Contributor on production subscriptions eligible rather than permanent.
PIM alerts: review the built-in alerts for roles assigned outside PIM and for too many Global Administrators.
If you want PIM designed and rolled out without disrupting your admins, our managed security service includes privileged access reviews, and the E5 vs E3 calculator can help you decide whether P2 through E5 or a standalone add-on is cheaper for your team. For Azure workloads, see our Azure security assessment.
Frequently asked questions
Does Microsoft 365 Business Premium include Privileged Identity Management?
No. Business Premium includes Microsoft Entra ID P1. PIM requires Entra ID P2 or Entra ID Governance, which you can add for just the admins who need it.
Who needs a P2 license for PIM?
Users with eligible or time-bound role assignments, users who approve activation requests, and users who perform or are assigned access reviews. Regular staff who never hold admin roles do not need P2 for PIM.
Should emergency access accounts be eligible in PIM?
No. Microsoft recommends permanent active Global Administrator for emergency access accounts so they work even when PIM, MFA or approvals are unavailable. Monitor every sign-in to them instead.
Want just-in-time admin without the overhead? Book a free Microsoft 365 security assessment and we will review your privileged roles and recommend the right PIM setup for your team.
Standing admin rights are a gift to attackers. An account that is Global Administrator around the clock is just as powerful at 3 a.m. on a Sunday as it is during a planned change. Privileged Identity Management, the just-in-time admin feature in Microsoft Entra ID, fixes that by making admin roles something you switch on for an hour when you need them, rather than something you carry all the time.
Small IT teams often assume PIM is an enterprise tool with enterprise overhead. It does not have to be. Here is a setup that works for a team of one to five people without slowing anyone down.
What Privileged Identity Management actually does
PIM changes how admin roles are assigned. Instead of a permanent assignment, an admin gets an eligible assignment. The role does nothing until the admin activates it, which can require MFA, a reason, a ticket number or approval from someone else. When the activation window ends, the role switches itself off.
The key features for a small business are:
PIM also covers Azure resource roles and groups through PIM for Groups, but most small businesses get the biggest win from Entra roles first.
Licensing: what you need before you start
PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. This is where many small businesses stop, because Microsoft 365 Business Premium includes Entra ID P1, not P2.
Your options:
Microsoft’s licensing guidance says the license is needed for users with eligible or time-bound assignments, users who approve activations, and users who perform access reviews. For a small team, that usually means licensing only your handful of admins, not the whole company. That makes PIM far more affordable than people expect.
If P2 is genuinely out of reach, the fallback is separate cloud-only admin accounts, phishing-resistant MFA for admins and a quarterly review of role assignments. It is not as strong, but it closes most of the gap.
A lightweight PIM setup for small teams
This configuration balances security with the reality that the same two people do everything.
ID Governance > Privileged Identity Management > Microsoft Entra roles.Suggested role settings
Avoiding the classic PIM lockout
Microsoft documents one scenario that will lock you out of your own tenant. It happens when all three of these are true at once:
Nobody can approve, so nobody can activate. The fix is simple: keep permanent active Global Administrator on your two emergency access accounts, and name at least two specific approvers. Review the approver list whenever someone leaves.
It is also worth knowing what happens if your P2 licenses lapse. Microsoft states that eligible assignments to Entra roles are removed, while permanent assignments are unaffected. In other words, admins who relied on activation lose their roles. Keep renewals on someone’s calendar and keep the emergency accounts in place.
Day-to-day use: what admins actually do
Once it is set up, an admin’s routine changes very little.
https://aka.ms/pim, which opens My roles.In the tenants I support, admins usually stop noticing the extra step within a couple of weeks. The owner, on the other hand, starts noticing the activation emails and gets a much clearer picture of who is changing what.
Getting more value from PIM over time
Once the basics are running, a few additions are worth the effort:
Microsoft’s setup guide, Start using Privileged Identity Management, covers prerequisites and first steps in detail.
If you want PIM designed and rolled out without disrupting your admins, our managed security service includes privileged access reviews, and the E5 vs E3 calculator can help you decide whether P2 through E5 or a standalone add-on is cheaper for your team. For Azure workloads, see our Azure security assessment.
Frequently asked questions
Does Microsoft 365 Business Premium include Privileged Identity Management?
No. Business Premium includes Microsoft Entra ID P1. PIM requires Entra ID P2 or Entra ID Governance, which you can add for just the admins who need it.
Who needs a P2 license for PIM?
Users with eligible or time-bound role assignments, users who approve activation requests, and users who perform or are assigned access reviews. Regular staff who never hold admin roles do not need P2 for PIM.
Should emergency access accounts be eligible in PIM?
No. Microsoft recommends permanent active Global Administrator for emergency access accounts so they work even when PIM, MFA or approvals are unavailable. Monitor every sign-in to them instead.
Want just-in-time admin without the overhead? Book a free Microsoft 365 security assessment and we will review your privileged roles and recommend the right PIM setup for your team.