Auditing privileged access: PIM, standing admin and just-in-time

EntraGUARD·2026-08-11·8 min

Standing administrative access is the largest self-inflicted risk in most tenants. Every permanent Global Administrator is a permanent target. Here is how to audit privileged access properly.

Standing administrative access is the single largest self-inflicted risk in most Microsoft tenants. Every account that is permanently a Global Administrator is a permanent target. Privileged Identity Management (PIM) exists to make that access just-in-time, time-bound and audited — but PIM only helps if it is actually configured and used. This is how to audit privileged access properly.

Count the standing privilege first

Begin with a census: which roles are assigned, to whom, and are they permanent or eligible. Permanent assignments to high-tier roles — Global Administrator, Privileged Role Administrator, Application Administrator, Exchange Administrator — are the findings that matter. A tenant with twelve permanent Global Admins has twelve standing keys to everything; the same tenant with two break-glass admins and the rest eligible-through-PIM has a fraction of the exposure.

What good PIM looks like

Eligible, not active — privileged roles are assigned as eligible; users activate them for a bounded window when needed.
Activation requires MFA — and, for the highest roles, approval.
Time-bound activation — hours, not open-ended, with justification recorded.
Access reviews — recurring reviews that expire assignments no longer needed.
Break-glass excluded — two emergency accounts stay permanent by design, with heavy monitoring.

Eligible is not the same as safe. PIM reduces standing exposure, but an eligible assignment a user can self-activate without approval or MFA is only marginally better than a permanent one. Audit the activation requirements, not just whether PIM is switched on.

The roles beyond Global Admin

Audits over-focus on Global Administrator and miss the roles that are nearly as dangerous. Application Administrator and Cloud Application Administrator can grant consent that leads to privilege escalation. Privileged Authentication Administrator can reset credentials for admins. Exchange and SharePoint administrators reach the data directly. Least privilege means assigning the narrowest role that does the job — and auditing whether that is what happened.

Tie it back to the attack path

Standing privilege is what turns a single compromised account into a tenant takeover. That is why privilege escalation is a scored path in the attack simulator: the fewer standing admins and the tighter the activation controls, the less viable the path. Auditing PIM and simulating escalation are two views of the same risk.