Describe the capabilities of Privileged identity Management

Privileged Identity Management (PIM) is a service of Microsoft Entra ID that enables you to manage, control, and monitor access to important resources in your organization. These include resources in Microsoft Entra, Azure, and other Microsoft online services such as Microsoft 365 or Microsoft Intune. PIM mitigates the risks of excessive, unnecessary, or misused access permissions. It requires justification to understand why users want permissions, and enforces multifactor authentication to activate any role.

PIM is:

• Just in time, providing privileged access only when needed, and not before.
• Time-bound, by assigning start and end dates that indicate when a user can access resources.
• Approval-based, requiring specific approval to activate privileges.
• Visible, sending notifications when privileged roles are activated.
• Auditable, allowing a full access history to be downloaded.

Why use PIM?

PIM reduces the chance of a malicious actor getting access by minimizing the number of people who have access to secure information or resources. By time-limiting authorized users, it reduces the risk of an authorized user inadvertently affecting sensitive resources. PIM also provides oversight for what users are doing with their administrator privileges.