Enable Azure AD Privileged Identity Management (PIM)

The lesson explains how Privileged Identity Management extends least privilege beyond standard RBAC role assignments. It then walks through configuring just-in-time access for the Global Administrator role, time-bound Owner access to an Azure subscription, and a PIM approval workflow for role elevation requests.

Just-in-time access requires the user to go through an activation and elevation process before using a role. Time-bound access assigns the role as active for a designated period without an activation step, which the trainer describes as a good fit for maintenance windows and standing up new environments.

When someone requests elevation into administrative privileges, a delegated approver must approve that request before it takes effect. The lesson starts by choosing who receives that approval permission, then shows the configuration for both Azure AD roles and Azure resource roles such as Owner and Contributor.

The lesson runs 22 minutes and is one part of the associate-level Microsoft Entra ID (formerly Azure Active Directory) course, which totals about 9.5 hours per learner. The wider course also covers users, groups, licenses, devices, password management, authentication, enterprise applications, app registration, and identity governance.

A team member can configure just-in-time access from PIM role settings, activate and deactivate an eligible role from My Roles, and set up time-bound Owner access to a subscription with a recorded justification. For an IT Director, that means admins can participate in privileged access workflows and use the PIM Azure resources dashboard to review active role assignments and changes for auditing.

CBT Nuggets supports team rollout with Playlists for structured assignment and Team Reporting to track completion across administrators. Team reporting provides per-learner progress and completion, cohort and group views, and completion exports that can serve as audit evidence.