This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Identify the role of Privileged Identity Management (PIM) in an organization

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Organizations using Microsoft 365 and Microsoft Entra ID must protect administrative accounts because these accounts have elevated permissions that can affect users, data, applications, and security settings. Permanent administrator access creates unnecessary risk because compromised accounts can be used to perform harmful actions.

Privileged Identity Management (PIM) is a Microsoft Entra feature that helps organizations manage, control, and monitor privileged access. PIM provides just-in-time (JIT) access to administrative roles so users receive elevated permissions only when they need them and only for a limited period.

For the AB-900 exam, it is important to understand the purpose, benefits, and key capabilities of PIM rather than the detailed configuration steps.

What Is Privileged Identity Management (PIM)?

Microsoft Entra Privileged Identity Management is a service that enables organizations to:

• Discover privileged accounts
• Assign roles securely
• Require approval before activation
• Limit how long elevated access remains active
• Audit administrative activities
• Reduce standing privileges

Instead of granting users permanent administrator rights, PIM allows them to activate privileged roles temporarily when needed.

Example

Without PIM:

• Alice is permanently assigned the Global Administrator role.

With PIM:

• Alice is eligible for the Global Administrator role.
• She activates the role only when performing administrative work.
• The role automatically expires after a defined period.

This approach follows the principle of least privilege and supports a Zero Trust security model.

Why Organizations Use PIM

Administrative accounts are attractive targets for attackers because they can:

• Reset passwords
• Change security settings
• Access sensitive data
• Create new accounts
• Disable protections

PIM helps organizations:

Reduce Security Risks

Users have elevated permissions only when necessary.

Limit Exposure Time

Temporary access decreases the amount of time privileged accounts can be exploited.

Increase Visibility

Organizations can monitor who activated roles and when.

Improve Compliance

Audit records help demonstrate compliance with regulatory requirements.

Support Zero Trust

PIM assumes no account should have continuous privileged access.

Just-in-Time (JIT) Access

One of the most important concepts in PIM is Just-in-Time access.

Traditional Access

User → Permanent Administrator Role

PIM Access

User → Eligible Role → Temporary Activation → Automatic Expiration

With JIT access:

• Permissions are granted only when needed.
• Access automatically expires after a specified duration.
• The attack surface is reduced.

Eligible vs. Active Assignments

PIM uses two assignment types.

Eligible Assignment

The user:

• Can activate the role when needed.
• Does not have permissions until activation occurs.

Example:

John is eligible for the Exchange Administrator role but normally has no Exchange administrative permissions.

Active Assignment

The user:

• Immediately possesses the role.
• Does not need to activate it.

Active assignments are sometimes used for emergency or service accounts but should be minimized whenever possible.

Role Activation Process

When users need elevated permissions, they activate their eligible role.

Activation can require:

• Multifactor authentication (MFA)
• A business justification
• Approval from another administrator
• A ticket number
• Time restrictions

After approval:

• The role becomes active.
• Permissions are available temporarily.
• Access expires automatically.

Approval Workflows

Organizations may require managers or security administrators to approve privileged access requests.

Example workflow:

1. User requests activation.
2. PIM sends approval request.
3. Approver reviews the request.
4. Access is granted for a limited time.
5. Role expires automatically.

Approval workflows add another layer of protection.

Time-Limited Access

PIM allows organizations to define activation durations.

Examples:

Benefits include:

• Reduced attack windows
• Automatic removal of privileges
• Better administrative control

Multifactor Authentication (MFA) for Role Activation

Organizations can require MFA before privileged access is activated.

This ensures:

• The user is verified.
• Stolen passwords alone cannot activate privileged roles.
• Additional security protects sensitive operations.

Example:

A Global Administrator may need to:

1. Sign in.
2. Complete MFA.
3. Enter a justification.
4. Activate the role.

Audit Logs and Activity Tracking

PIM records privileged activities, including:

• Role assignments
• Activation requests
• Approval actions
• Expiration events
• Administrative changes

Audit logs help organizations:

• Investigate incidents.
• Meet compliance requirements.
• Understand who performed sensitive actions.

Access Reviews

PIM supports periodic access reviews.

These reviews help organizations determine:

• Whether users still require privileged access.
• Whether inactive assignments should be removed.
• Whether excessive permissions exist.

Access reviews reduce privilege creep over time.

Alerts and Notifications

PIM can generate alerts for risky situations such as:

• Too many Global Administrators.
• Permanent role assignments.
• Suspicious activation activity.
• Administrators not using MFA.

Notifications can also be sent to administrators when:

• Roles are activated.
• Requests are approved.
• Changes occur.

Resources Protected by PIM

PIM can manage privileged access for:

Microsoft Entra Roles

Examples:

• Global Administrator
• User Administrator
• Security Administrator
• Exchange Administrator

Azure Resource Roles

Examples:

• Owner
• Contributor
• User Access Administrator

Groups

PIM can manage membership and ownership of privileged groups.

Common Roles Managed by PIM

Examples include:

Benefits of PIM

Organizations implementing PIM gain:

• Reduced standing privileges
• Stronger security
• Just-in-time access
• Automatic expiration of permissions
• Approval workflows
• Better auditing
• Compliance support
• Reduced insider risk
• Support for Zero Trust principles

Relationship Between PIM and Zero Trust

PIM aligns closely with Zero Trust principles:

Verify Explicitly

Require MFA and approvals.

Use Least Privilege Access

Grant only necessary permissions.

Assume Breach

Limit exposure if an account becomes compromised.

Because of this alignment, PIM is considered an important security control in Microsoft environments.

Key Exam Points

Remember these AB-900 concepts:

• PIM manages privileged access.
• PIM reduces permanent administrator permissions.
• Just-in-time access grants temporary privileges.
• Users can be eligible or active.
• MFA can be required before activation.
• Approvals and justifications may be required.
• Audit logs record privileged activities.
• Access reviews help remove unnecessary privileges.
• PIM supports Zero Trust and least privilege principles.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Entra Privileged Identity Management?

A. Increase mailbox storage quotas
B. Configure SharePoint sites
C. Synchronize on-premises users with Microsoft 365
D. Manage and secure privileged access to resources

Correct Answer: D

Explanation: PIM helps organizations manage and secure privileged access by providing temporary, controlled administrator permissions.

Question 2

Which security principle is most closely supported by PIM?

A. Permanent administrative access
B. Open access permissions
C. Least privilege access
D. Shared administrator accounts

Correct Answer: C

Explanation: PIM grants elevated permissions only when needed, supporting least privilege.

Question 3

A user who can activate a role when needed but does not currently possess permissions has which type of assignment?

A. Resource assignment
B. Permanent assignment
C. Dynamic assignment
D. Eligible assignment

Correct Answer: D

Explanation: Eligible users activate roles only when necessary.

Question 4

What does Just-in-Time (JIT) access provide?

A. Permanent access to all services
B. Access only after synchronization occurs
C. Access to guest users only
D. Temporary elevated permissions when required

Correct Answer: D

Explanation: JIT access minimizes risk by limiting how long privileged permissions remain active.

Question 5

Which control can be required before a user activates a privileged role?

A. Disk encryption
B. Multifactor authentication
C. SharePoint versioning
D. Mail flow rules

Correct Answer: B

Explanation: MFA is commonly required before privileged access activation.

Question 6

What happens when the activation period ends?

A. Permissions are automatically removed
B. The account is deleted
C. The role becomes permanent
D. The user is blocked from signing in

Correct Answer: A

Explanation: PIM automatically removes elevated permissions after the configured duration expires.

Question 7

Which feature helps determine whether users still require privileged access?

A. Defender for Endpoint
B. Mail flow rules
C. Access reviews
D. Data loss prevention

Correct Answer: C

Explanation: Access reviews help organizations remove unnecessary privileges.

Question 8

Why do organizations prefer eligible assignments over permanent active assignments?

A. Eligible assignments require fewer licenses
B. Eligible assignments reduce standing administrative access
C. Eligible assignments eliminate the need for MFA
D. Eligible assignments disable audit logs

Correct Answer: B

Explanation: Temporary access reduces the attack surface and lowers risk.

Question 9

Which information can PIM audit logs capture?

A. Printer usage statistics
B. Browser history
C. Employee salaries
D. Role activations and approvals

Correct Answer: D

Explanation: PIM logs privileged activities such as activations, approvals, and assignments.

Question 10

Which role would commonly be managed through PIM?

A. Marketing Coordinator
B. Sales Representative
C. Global Administrator
D. Receptionist

Correct Answer: C

Explanation: Administrative roles with elevated permissions are ideal candidates for PIM management.

Go to the AB-900 Exam Prep Hub main page