Understanding Azure AD Privileged Identity Management

Azure Active Directory (AAD) Privileged Identity Management (PIM) can help organizations manage, control, and audit use by administrators of AAD itself, as well as other Microsoft hosted services like Office 365 and Intune. In particular, PIM provides an audit trail for most administrative roles of Microsoft hosted services. This information could help minimize the risk posed by a set of lost administrative credentials and also give insight into the actions of a rogue administrator. PIM is a key feature in the AAD Premium P2-level User Subscription License (SL).

What Is AAD Privileged Identity Management?

PIM is an AAD feature that provides just-in-time (JIT) management of administrative credentials used with AAD, Office 365, and Intune.

PIM can help organizations understand administrative activity occurring in their Microsoft hosted services, maintain compliance with industry and geographic standards, and potentially reduce the number of administrators required.

In a traditional scenario, the rights granted by roles and privileges of administrators who are not managed by PIM are always fully enabled, which poses a potential security risk.