Privileged Identity Management (PIM)

What is privileged identity management?

Privileged identity management (PIM) is an identity governance control that decides which identities may hold privileged roles and makes those roles eligible rather than permanent. An administrator activates the role only when needed, for a limited time, with a justification, MFA and, for sensitive roles, an approval. Regular reviews confirm who is still eligible. In Microsoft Entra ID, Privileged Identity Management is also the name of a feature.

Key takeaways

• Privileged identity management makes privileged roles eligible instead of permanent, so an administrator activates a role only when needed and for a limited time.
• Privileged identity management controls who may hold a privileged role, while privileged access management secures the credentials and sessions used with that role.
• Privileged identity management in Microsoft Entra ID requires Microsoft Entra ID Governance or Microsoft Entra ID P2 licenses.
• Privileged identity management still needs periodic reviews of eligible assignments, because an unused eligible role remains a path to admin rights.

How privileged identity management works

• Eligible assignment: a user is made eligible for a role instead of being permanently assigned to it, so nothing is active by default.
• Activation: when the work requires it, the user requests the role, gives a justification (often a ticket number) and completes MFA.
• Approval: for the most sensitive roles, a named approver confirms the request before the role becomes active.
• Time limit: the role expires automatically after a set duration, for example a few hours, without anyone having to remove it.
• Review and audit: eligible assignments are recertified on a schedule, and every activation is logged with who, when and why.

PIM vs PAM: what is the difference?

• Privileged identity management (PIM): governs the identities. It answers who may become an administrator, under which conditions and for how long.
• Privileged access management (PAM): governs the access itself. It vaults privileged credentials, brokers connections to servers and databases and records privileged sessions.

The two are complementary. A mid-market company often starts with PIM in its identity provider, because it removes standing admin rights quickly, then adds PAM where shared root or database accounts exist. One disambiguation: in e-commerce, PIM means product information management, software that centralizes product data for catalogs, and has nothing to do with identity.

Examples and use cases

A 220-person software company finds nine permanent Global Administrators in Microsoft Entra ID. With privileged identity management, it keeps two excluded break-glass accounts, makes everyone else eligible and requires a justification, MFA and approval to activate the role for up to four hours. Eligibility is reviewed every quarter. The Entra ID roles are now under control, but admin rights inside 40 SaaS tools, from the CRM to the payroll system, still sit outside PIM.

Corma covers that SaaS side. It inventories the applications in use, runs automated access reviews with audit evidence across them, routes access requests through approval workflows and automates deprovisioning when people leave, including in applications without SCIM.

Related concepts

• Privileged access management (PAM)
• Just-in-time access (JIT)
• Principle of least privilege
• Break-glass access
• Microsoft Entra ID (formerly Azure AD)
• Corma identity governance and administration platform

FAQ

What is the difference between PIM and PAM?

PIM decides which identities may hold privileged roles and for how long. PAM protects the privileged credentials and sessions themselves, with vaulting and session recording. Many organizations need both.

Which license does Microsoft Entra PIM require?

Microsoft Entra Privileged Identity Management requires Microsoft Entra ID Governance or Microsoft Entra ID P2 licenses.

What is an eligible role assignment?

It is a role a user may activate but does not hold by default. The role becomes active only after activation, with justification, MFA and approval where required, and it expires automatically.

Does PIM also mean product information management?

Yes, in e-commerce and retail PIM means product information management, software for product catalog data. In identity security, PIM means privileged identity management.

Request a demo