This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
--> Identify the core security features of Microsoft 365 services
--> Identify the role of Privileged Identity Management (PIM) in an organization
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.
Introduction
Organizations using Microsoft 365 and Microsoft Entra ID must protect administrative accounts because these accounts have elevated permissions that can affect users, data, applications, and security settings. Permanent administrator access creates unnecessary risk because compromised accounts can be used to perform harmful actions.
Privileged Identity Management (PIM) is a Microsoft Entra feature that helps organizations manage, control, and monitor privileged access. PIM provides just-in-time (JIT) access to administrative roles so users receive elevated permissions only when they need them and only for a limited period.
For the AB-900 exam, it is important to understand the purpose, benefits, and key capabilities of PIM rather than the detailed configuration steps.
What Is Privileged Identity Management (PIM)?
Microsoft Entra Privileged Identity Management is a service that enables organizations to:
- Discover privileged accounts
- Assign roles securely
- Require approval before activation
- Limit how long elevated access remains active
- Audit administrative activities
- Reduce standing privileges
Instead of granting users permanent administrator rights, PIM allows them to activate privileged roles temporarily when needed.
Example
Without PIM:
- Alice is permanently assigned the Global Administrator role.
With PIM:
- Alice is eligible for the Global Administrator role.
- She activates the role only when performing administrative work.
- The role automatically expires after a defined period.
This approach follows the principle of least privilege and supports a Zero Trust security model.
Why Organizations Use PIM
Administrative accounts are attractive targets for attackers because they can:
- Reset passwords
- Change security settings
- Access sensitive data
- Create new accounts
- Disable protections
PIM helps organizations:
Reduce Security Risks
Users have elevated permissions only when necessary.
Limit Exposure Time
Temporary access decreases the amount of time privileged accounts can be exploited.
Increase Visibility
Organizations can monitor who activated roles and when.
Improve Compliance
Audit records help demonstrate compliance with regulatory requirements.
Support Zero Trust
PIM assumes no account should have continuous privileged access.
Just-in-Time (JIT) Access
One of the most important concepts in PIM is Just-in-Time access.
Traditional Access
User → Permanent Administrator Role
PIM Access
User → Eligible Role → Temporary Activation → Automatic Expiration
With JIT access:
- Permissions are granted only when needed.
- Access automatically expires after a specified duration.
- The attack surface is reduced.
Eligible vs. Active Assignments
PIM uses two assignment types.
Eligible Assignment
The user:
- Can activate the role when needed.
- Does not have permissions until activation occurs.
Example:
John is eligible for the Exchange Administrator role but normally has no Exchange administrative permissions.
Active Assignment
The user:
- Immediately possesses the role.
- Does not need to activate it.
Active assignments are sometimes used for emergency or service accounts but should be minimized whenever possible.
Role Activation Process
When users need elevated permissions, they activate their eligible role.
Activation can require:
- Multifactor authentication (MFA)
- A business justification
- Approval from another administrator
- A ticket number
- Time restrictions
After approval:
- The role becomes active.
- Permissions are available temporarily.
- Access expires automatically.
Approval Workflows
Organizations may require managers or security administrators to approve privileged access requests.
Example workflow:
- User requests activation.
- PIM sends approval request.
- Approver reviews the request.
- Access is granted for a limited time.
- Role expires automatically.
Approval workflows add another layer of protection.
Time-Limited Access
PIM allows organizations to define activation durations.
Examples:
| Role | Duration |
|---|---|
| Global Administrator | 1 hour |
| Exchange Administrator | 4 hours |
| SharePoint Administrator | 2 hours |
Benefits include:
- Reduced attack windows
- Automatic removal of privileges
- Better administrative control
Multifactor Authentication (MFA) for Role Activation
Organizations can require MFA before privileged access is activated.
This ensures:
- The user is verified.
- Stolen passwords alone cannot activate privileged roles.
- Additional security protects sensitive operations.
Example:
A Global Administrator may need to:
- Sign in.
- Complete MFA.
- Enter a justification.
- Activate the role.
Audit Logs and Activity Tracking
PIM records privileged activities, including:
- Role assignments
- Activation requests
- Approval actions
- Expiration events
- Administrative changes
Audit logs help organizations:
- Investigate incidents.
- Meet compliance requirements.
- Understand who performed sensitive actions.
Access Reviews
PIM supports periodic access reviews.
These reviews help organizations determine:
- Whether users still require privileged access.
- Whether inactive assignments should be removed.
- Whether excessive permissions exist.
Access reviews reduce privilege creep over time.
Alerts and Notifications
PIM can generate alerts for risky situations such as:
- Too many Global Administrators.
- Permanent role assignments.
- Suspicious activation activity.
- Administrators not using MFA.
Notifications can also be sent to administrators when:
- Roles are activated.
- Requests are approved.
- Changes occur.
Resources Protected by PIM
PIM can manage privileged access for:
Microsoft Entra Roles
Examples:
- Global Administrator
- User Administrator
- Security Administrator
- Exchange Administrator
Azure Resource Roles
Examples:
- Owner
- Contributor
- User Access Administrator
Groups
PIM can manage membership and ownership of privileged groups.
Common Roles Managed by PIM
Examples include:
| Role | Purpose |
|---|---|
| Global Administrator | Full Microsoft 365 administration |
| Exchange Administrator | Manage Exchange Online |
| SharePoint Administrator | Manage SharePoint Online |
| Teams Administrator | Manage Microsoft Teams |
| Security Administrator | Configure security settings |
| User Administrator | Manage users and groups |
Benefits of PIM
Organizations implementing PIM gain:
- Reduced standing privileges
- Stronger security
- Just-in-time access
- Automatic expiration of permissions
- Approval workflows
- Better auditing
- Compliance support
- Reduced insider risk
- Support for Zero Trust principles
Relationship Between PIM and Zero Trust
PIM aligns closely with Zero Trust principles:
Verify Explicitly
Require MFA and approvals.
Use Least Privilege Access
Grant only necessary permissions.
Assume Breach
Limit exposure if an account becomes compromised.
Because of this alignment, PIM is considered an important security control in Microsoft environments.
Key Exam Points
Remember these AB-900 concepts:
- PIM manages privileged access.
- PIM reduces permanent administrator permissions.
- Just-in-time access grants temporary privileges.
- Users can be eligible or active.
- MFA can be required before activation.
- Approvals and justifications may be required.
- Audit logs record privileged activities.
- Access reviews help remove unnecessary privileges.
- PIM supports Zero Trust and least privilege principles.
Practice Exam Questions
Question 1
What is the primary purpose of Microsoft Entra Privileged Identity Management?
A. Increase mailbox storage quotas
B. Configure SharePoint sites
C. Synchronize on-premises users with Microsoft 365
D. Manage and secure privileged access to resources
Correct Answer: D
Explanation: PIM helps organizations manage and secure privileged access by providing temporary, controlled administrator permissions.
Question 2
Which security principle is most closely supported by PIM?
A. Permanent administrative access
B. Open access permissions
C. Least privilege access
D. Shared administrator accounts
Correct Answer: C
Explanation: PIM grants elevated permissions only when needed, supporting least privilege.
Question 3
A user who can activate a role when needed but does not currently possess permissions has which type of assignment?
A. Resource assignment
B. Permanent assignment
C. Dynamic assignment
D. Eligible assignment
Correct Answer: D
Explanation: Eligible users activate roles only when necessary.
Question 4
What does Just-in-Time (JIT) access provide?
A. Permanent access to all services
B. Access only after synchronization occurs
C. Access to guest users only
D. Temporary elevated permissions when required
Correct Answer: D
Explanation: JIT access minimizes risk by limiting how long privileged permissions remain active.
Question 5
Which control can be required before a user activates a privileged role?
A. Disk encryption
B. Multifactor authentication
C. SharePoint versioning
D. Mail flow rules
Correct Answer: B
Explanation: MFA is commonly required before privileged access activation.
Question 6
What happens when the activation period ends?
A. Permissions are automatically removed
B. The account is deleted
C. The role becomes permanent
D. The user is blocked from signing in
Correct Answer: A
Explanation: PIM automatically removes elevated permissions after the configured duration expires.
Question 7
Which feature helps determine whether users still require privileged access?
A. Defender for Endpoint
B. Mail flow rules
C. Access reviews
D. Data loss prevention
Correct Answer: C
Explanation: Access reviews help organizations remove unnecessary privileges.
Question 8
Why do organizations prefer eligible assignments over permanent active assignments?
A. Eligible assignments require fewer licenses
B. Eligible assignments reduce standing administrative access
C. Eligible assignments eliminate the need for MFA
D. Eligible assignments disable audit logs
Correct Answer: B
Explanation: Temporary access reduces the attack surface and lowers risk.
Question 9
Which information can PIM audit logs capture?
A. Printer usage statistics
B. Browser history
C. Employee salaries
D. Role activations and approvals
Correct Answer: D
Explanation: PIM logs privileged activities such as activations, approvals, and assignments.
Question 10
Which role would commonly be managed through PIM?
A. Marketing Coordinator
B. Sales Representative
C. Global Administrator
D. Receptionist
Correct Answer: C
Explanation: Administrative roles with elevated permissions are ideal candidates for PIM management.
Go to the AB-900 Exam Prep Hub main page
The Data Community 