PIM Dojo

Tenant Defence Score
0 / 1000
Current Rank
No belt yet
0 governed 0 eligible 0 in scope

A permanent Global Administrator works just as well at 3am on a Sunday as it does on a Monday morning — for whoever holds the credential. Privileged Identity Management turns that into access you have to ask for: with a reason, for a couple of hours, with someone else saying yes. The Privileged Access Dojo designs the model; this one governs how people get into it.

Read this first — you can lock everyone out, and it's documented

PIM is the one tool in this suite that can remove your own ability to administer your tenant. Microsoft documents the exact combination, and every condition in it looks like good practice on its own:

With no approvers named, the default approver is an active Global Administrator or Privileged Role Administrator. By the first condition, there aren't any. Nobody can activate. Nobody can approve. Nobody can fix it.

The protection is one account: a break-glass account with a permanent active Global Administrator assignment, excluded from every Conditional Access policy, that you have actually signed in with. Not planned — tested. The Privileged Access Dojo owns that account's whole lifecycle, so the guidance lives in exactly one place.

Full guidance: Configure Microsoft Entra role settings in PIM ↗

Size up your environment

Two questions. The licence mix is decisive here in a way it isn't elsewhere in the suite — PIM has no free or P1 tier, so if nobody has P2 this dojo will tell you honestly rather than scoring you against something you can't buy your way into halfway.

Which licences do you have in the tenant? Select all that apply.

PIM needs Entra ID P2 or Entra ID Governance. There is no reduced version on P1 or Business Premium. If that's you, three controls here still apply — and they're the ones worth knowing anyway.

Do you run Azure subscriptions?

PIM covers Azure resource roles as well as directory roles. Owner on a production subscription is worth as much to an attacker as Global Administrator, and is usually far less governed.

Walk out with a plan

Your deployment plan lists every in-scope control with its status, MITRE references and Microsoft Learn source. The PowerShell script contains the audit queries for your in-scope controls, in belt order — every read ready to run, every write commented out. A lot of PIM is genuinely portal work, because the role policy objects are awkward to build by hand; the reads here tell you exactly what needs changing.