A permanent Global Administrator works just as well at 3am on a Sunday as it does on a Monday morning — for whoever holds the credential. Privileged Identity Management turns that into access you have to ask for: with a reason, for a couple of hours, with someone else saying yes. The Privileged Access Dojo designs the model; this one governs how people get into it.
Read this first — you can lock everyone out, and it's documented
PIM is the one tool in this suite that can remove your own ability to administer your tenant. Microsoft documents the exact combination, and every condition in it looks like good practice on its own:
- Every Global Admin and Privileged Role Admin is eligible, none active. Sensible — that's the whole point of PIM.
- Approval is required to activate. Also sensible — a second human on the highest privilege.
- No specific approvers are named. Easy to miss, because the field can simply be left empty.
With no approvers named, the default approver is an active Global Administrator or Privileged Role Administrator. By the first condition, there aren't any. Nobody can activate. Nobody can approve. Nobody can fix it.
The protection is one account: a break-glass account with a permanent active Global Administrator assignment, excluded from every Conditional Access policy, that you have actually signed in with. Not planned — tested. The Privileged Access Dojo owns that account's whole lifecycle, so the guidance lives in exactly one place.
- Look before you convert. Discovery and insights gives you a baseline you'll want later.
- One role at a time, and not Global Administrator first. Learn the flow where the blast radius is smaller.
- Eligible first, then remove the active assignment. Never leave someone with neither — least of all yourself.
- Name approvers explicitly, every time. An empty list is the trap above.
Full guidance: Configure Microsoft Entra role settings in PIM ↗
Size up your environment
Two questions. The licence mix is decisive here in a way it isn't elsewhere in the suite — PIM has no free or P1 tier, so if nobody has P2 this dojo will tell you honestly rather than scoring you against something you can't buy your way into halfway.
Which licences do you have in the tenant? Select all that apply.
PIM needs Entra ID P2 or Entra ID Governance. There is no reduced version on P1 or Business Premium. If that's you, three controls here still apply — and they're the ones worth knowing anyway.
Do you run Azure subscriptions?
PIM covers Azure resource roles as well as directory roles. Owner on a production subscription is worth as much to an attacker as Global Administrator, and is usually far less governed.
Walk out with a plan
Your deployment plan lists every in-scope control with its status, MITRE references and Microsoft Learn source. The PowerShell script contains the audit queries for your in-scope controls, in belt order — every read ready to run, every write commented out. A lot of PIM is genuinely portal work, because the role policy objects are awkward to build by hand; the reads here tell you exactly what needs changing.