What Is Privileged Identity Management? PIM vs PAM for IT

Short answer: Privileged identity management (PIM) is an identity security practice that controls who holds privileged roles, for how long, and under what conditions. Instead of permanent admin rights, users are made eligible for a role and activate it only when needed, with MFA, a justification or an approval, and the role expires on its own.

How privileged identity management works

Privileged identity management works by replacing standing admin rights with eligibility. A user is assigned a role as "eligible" rather than "active", and must activate it before using it. Microsoft's documentation describes the same four stages most PIM tools follow (Microsoft Learn):

1. Assign: an administrator makes a user, group or service principal eligible for a role, at a defined scope, either permanently or between start and end dates.
2. Activate: when the user needs the role, they request it for a set duration within a configured maximum and give a reason. Activation can require an MFA check.
3. Approve: if the role is configured for approval, a designated approver accepts or denies the request.
4. Expire: the role drops back to eligible when the activation window ends, and the whole cycle is logged.

Microsoft states that an eligible assignment grants exactly the same access as a permanent one once activated. The only difference is that the user does not hold that access all the time.

Why PIM matters for IT teams

Privileged identity management matters because standing admin rights are the access an attacker most wants to inherit. NIST defines a privileged account as "a system account with the authorizations of a privileged user" (NIST CSRC glossary), and every such account that is always on widens the blast radius of one phished session.

Microsoft frames the goal of its PIM service as reducing the chance of a malicious actor getting access and of an authorized user accidentally changing a sensitive resource (Microsoft Learn). In practice, PIM turns least privilege from a policy document into a control: the Global Administrator role sits empty most of the day, and every use of it leaves an activation record with a name, a reason and a time.

Key components of a PIM program

A privileged identity management program, whatever tool runs it, usually includes these controls. The list mirrors the feature set Microsoft documents for Entra PIM (Microsoft Learn):

• Just-in-time access: roles granted only for the time a task needs.
• Time-bound assignments: eligibility itself has start and end dates, useful for contractors and projects.
• Activation conditions: MFA, a written justification, or approval before a role goes live.
• Notifications: alerts when privileged roles are activated.
• Access reviews: scheduled checks that each person still needs each role.
• Audit history: exportable logs for internal and external auditors.
• Guardrails: Entra PIM, for example, prevents removal of the last active Global Administrator and Privileged Role Administrator assignments.

PIM vs PAM: where vendors draw the line

PIM and PAM are related but not the same. Privileged identity management governs the identity layer: who holds a privileged role and for how long. Privileged access management governs the access layer: how that identity reaches a server, database or console, what it does in the session, and what evidence is recorded. Teleport puts it as PIM defining "who should have access" while PAM controls how that access is exercised (Teleport). Delinea treats both as subsets of identity and access management and notes the overlap makes people use the terms "as if they were fully interchangeable" (Delinea).

Sources: Teleport, Delinea and Microsoft Learn pages cited above, checked September 22, 2026.

PIM vs PAM vs IAM is the three-way version of the same question. Identity and access management is the umbrella term: it covers every identity in the organisation and the everyday access each one holds. PIM and PAM are its privileged subsets, which is why Delinea treats both as subsets of identity and access management (Delinea). Separate them by scope: IAM covers all identities, PIM governs who may hold a privileged role, and PAM controls how that privileged session runs.

Watch out: Microsoft's documented Entra PIM feature list covers role eligibility, activation, approvals, reviews and audit history; it does not list password vaulting or recording sessions on servers (Microsoft Learn). Teams that need those controls for local admin, root or database accounts evaluate a PAM platform alongside it.

What Microsoft Entra PIM requires

Microsoft Entra Privileged Identity Management is included in Microsoft Entra ID P2, Microsoft Entra ID Governance and the Microsoft Entra Suite, and not in the Free or P1 tiers (Microsoft Learn licensing fundamentals, updated July 29, 2026). Entra PIM manages Microsoft Entra roles, Azure resource roles and group membership or ownership through PIM for Groups.

Licenses are counted by who takes part, not only by who configures it. Microsoft lists users with eligible or time-bound assignments, users who approve activations, and users assigned to or performing access reviews. Its own worked example: 50 administrators, 42 managed through PIM, five approvers and six reviewers who are not PIM-managed admins need 53 licenses.

Admin tip: Microsoft notes that Microsoft Entra ID P2 includes the PIM features generally available today, but that no new identity governance features will be added to the P2 SKU; newer items such as PIM custom extensions for role activation are listed only under Microsoft Entra ID Governance.

Common misconceptions about PIM

• "PIM is a Microsoft product." Microsoft sells a product called Privileged Identity Management, but the practice predates it and other identity and PAM vendors describe their own PIM capabilities (Delinea).
• "PIM replaces PAM." PIM decides who can be an admin and when; it does not by itself vault shared credentials or record what happens on a server (Teleport).
• "Eligible means less powerful." Microsoft states there is no difference in access between an activated eligible assignment and a permanent one (Microsoft Learn).
• "Only the admins need a license." In Entra PIM, approvers and reviewers count too (Microsoft Learn licensing fundamentals).

Privileged identity management in practice

What to look for in a PIM or PAM tool

When you move from learning to shortlisting, check these points against your environment:

• Coverage: cloud directory roles only, or also servers, databases, network devices and SaaS consoles.
• Activation controls: MFA, approvals, justification and maximum duration per role.
• Review and audit: scheduled access reviews and exportable history your auditor accepts.
• Licensing math: who counts toward seats, including approvers and reviewers.
• Failure behavior: what happens to assignments if the license, service or IdP is unavailable.

The privileged access management category hub lists the PAM platforms covered on this site, and the shortlist builder turns requirements like these into a checklist.

Bottom line

If your privileged roles live mostly in Microsoft Entra ID and Azure and you already hold P2 or ID Governance licenses, turning on Entra PIM for every standing admin role is the cheapest least-privilege win available. The picture changes once privileged access extends to on-prem servers, databases and shared root credentials, where PIM alone leaves the session unrecorded. Start with the privileged access management category hub to see which platforms cover that gap.