Plan and implement identity governance
Privileged Identity Management
PIM makes role assignments eligible instead of permanent. Activation can require approval, MFA, and justification, and is time-bound to a maximum duration. Settings exist at the role level (applying to all assignments) and can be overridden per assignment. PIM for Groups delivers just-in-time membership and ownership, including for role-assignable groups. PIM requires Entra ID P2.
Access reviews
A review asks a reviewer - manager, group owner, the user themselves, or a designated reviewer - to confirm or deny access on a schedule. When the instance completes, Auto apply results removes denied access; without it, nothing changes. Reviews cover group membership, application access, and PIM role assignments, and are the standard control for guest accounts.
Entitlement management
Catalogs bundle resources; access packages define what a requester receives, with policies for who may request, approval stages, expiry, and linked access reviews. Users request through My Access, and requests can auto-approve or require one or two approval stages.
Lifecycle workflows
Joiner-mover-leaver automation triggers on attribute changes: issue a Temporary Access Pass on day one, add groups on department change, disable the account on the leave date, and delete it after a grace period.
Traps
- Access reviews need P2; entitlement management and lifecycle workflows need Entra ID Governance.
- Toggling auto-apply after a review has ended does nothing until the next instance runs.
- Assignment-level PIM settings override role-level settings, not the reverse.
- Removing an access package assignment does not delete the user; it only removes what the package granted.
Rule of thumb
Eligible plus approval plus MFA plus justification plus expiry is the default posture for privileged roles; keep permanent Global Administrator limited to break-glass accounts.