Permanent admin accounts are a major security risk — if compromised, an attacker has full control. Entra ID Privileged Identity Management (PIM) enables just-in-time admin access, dramatically reducing this exposure.
Key takeaways
- 1Admin accounts exist but have no active admin role by default
- 2When admin work is needed, the user activates their eligible role — providing a justification and MFA
- 3The role is active for a defined window (e.g. 4 hours)
- 4After the window expires, the role is automatically deactivated
- 5Every activation is logged with the justification and duration
Admin accounts in Microsoft 365 are the most valuable accounts for an attacker to compromise. A compromised Global Administrator can do anything in your tenant — create new accounts, access all mailboxes, disable security controls, exfiltrate all data. Most organisations leave admin accounts permanently enabled, meaning the window for an attacker to abuse a compromised admin account is unlimited.
What Privileged Identity Management does
PIM is a feature of Microsoft Entra ID P2 (available in some Business Premium configurations and worth the add-on for any organisation with sensitive data). PIM changes the model from permanent admin assignments to eligible assignments:
- Admin accounts exist but have no active admin role by default
- When admin work is needed, the user activates their eligible role — providing a justification and MFA
- The role is active for a defined window (e.g. 4 hours)
- After the window expires, the role is automatically deactivated
- Every activation is logged with the justification and duration
Applying PIM to Global Administrator
Global Administrator should never be a permanent assignment. Optimyze configures PIM for all admin roles — particularly Global Admin, Exchange Admin, and Security Admin — for clients on appropriate licences. The result: even if an admin account is compromised, the attacker gains no elevated privileges unless they can also complete the activation flow (which requires MFA and logs the event).
The minimum viable alternative
For clients on standard Business Premium (Entra P1), the minimum alternative to PIM is: use separate admin accounts from daily-use accounts, never use Global Admin for routine tasks, enable MFA on all admin accounts, and review admin role assignments monthly. Optimyze includes admin account review in every monthly client check.
