Configure Just-in-Time Microsoft Entra Role Activation with PIM

This walkthrough configures a pilot Microsoft Entra role for just-in-time (JIT) activation. The user becomes eligible, requests temporary access when needed, and loses the active assignment when it expires or is deactivated.

Keep an independent emergency access path

Do not remove, convert, or include your emergency access accounts in this pilot. Confirm that your tenant has a tested emergency access procedure and at least one appropriately protected, active administrative path before changing privileged role settings.

Check licensing and approver availability first

PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licensing. Users with eligible or time-bound PIM assignments and users who approve activations need appropriate licenses. The Privileged Role Administrator role is required to manage Microsoft Entra role assignments and settings. Microsoft recommends at least two approvers when approval is required.

01

Choose a Least-Privilege Pilot Role

Preflight

Use a tenant where you are authorized to administer Microsoft Entra roles. Select one test user and the least-privileged role that covers a planned, reversible task. An example might be a service administrator role in a non-production tenant. Review current assignments and role settings first, and identify two available approvers if you plan to require approval.

Tenant and PIM license confirmed:
Privileged Role Administrator available:
Pilot user and approved task:
Least-privilege role selected:
Two approvers identified and licensed:
Emergency access procedure confirmed:

❯ Illustrative Output (Results Vary)

Proceed only when the pilot role, user, approvers, and recovery path are approved.

---

02

Set the Role's Activation Controls

Policy Setup

In the Microsoft Entra admin center, open ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, select the pilot role, then choose Role settings > Edit. Set a maximum activation duration that matches the task, require multifactor authentication and a business justification, and enable approval only if the designated approvers can respond. Select at least two approvers, then save. These settings apply to all assignments of this role.

Role: the approved least-privilege pilot role
Activation maximum duration: approved task window
On activation, require multifactor authentication: enabled
Require justification on activation: enabled
Require approval to activate: enabled only if planned
Approvers: at least two available, licensed users

❯ Illustrative Output (Results Vary)

The role settings show the reviewed activation duration and required controls.

Do not configure approval without a working approver path

Microsoft Entra role settings have no default approvers. Confirm that at least two named approvers can use PIM before enabling approval. Keep another active administrative path so a missing or unavailable approver cannot prevent recovery.

---

03

Assign the Pilot User as Eligible

Eligible Assignment

Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, select Add assignments, choose the approved role and pilot user, and set Assignment type to Eligible. Add a start and end date for the pilot assignment, review the summary, and assign it. Do not use an active assignment for this JIT test; an active assignment grants the role’s permissions without activation.

Role: approved pilot role
Member: one approved test user
Assignment type: Eligible
Start and end: approved pilot dates
Emergency access accounts: excluded from this change

❯ Illustrative Output (Results Vary)

The user appears under Eligible assignments for the selected role.

---

04

Submit an Activation Request

User Test

Sign in as the eligible pilot user and open ID Governance > Privileged Identity Management > My roles > Microsoft Entra roles. Select the eligible role and choose Activate. Satisfy any required multifactor authentication, enter a specific business reason, provide any required ticket information, choose a duration within the configured maximum, and submit the request.

Activation reason: the approved task and change reference
Duration: no longer than the configured maximum
Approval: submit the request and wait for its status

❯ Illustrative Output (Results Vary)

With approval enabled: the request is pending until an approver acts.
Without approval: the role becomes active after the request succeeds.

An existing sign-in may already satisfy multifactor authentication

PIM may not show a new multifactor prompt if the current sign-in session already contains an acceptable authentication claim. If your requirement is to demand a fresh or specific authentication method at activation, configure and test the supported Conditional Access authentication context and authentication strength controls for the role.

---

05

Approve the Request and Verify the Active Role

Approval

If approval is configured, have a different designated approver open ID Governance > Privileged Identity Management > Approve requests, inspect the user, role, duration, and justification, then approve or deny according to the change. As the pilot user, confirm the activation status and that the expected role is active. Perform only the authorized task during the approved window.

Approver: a designated reviewer other than the requester
Review: user, role, business reason, and requested duration
Decision: approve only when the request is valid
Pilot user: verify active status before the approved task

❯ Illustrative Output (Results Vary)

The request history records the decision and the role is active only for the approved interval.

---

06

Deactivate and Review the Audit Record

Validation

When the task is complete, return to My roles > Microsoft Entra roles and deactivate the role if the control is available. Otherwise, let the configured activation expire. Review PIM’s audit history for the assignment, activation request, approval, and deactivation or expiration. Confirm that the user is no longer active; some applications can cache authorization, so validate access in the target application as well.

Record the request and approval outcome:
Record the activation and end time:
Confirm the active assignment is removed:
Confirm target application access reflects the change:

❯ Illustrative Output (Results Vary)

The user remains eligible only for the approved pilot period and has no active role outside an activation window.

Upstream references

See Microsoft’s PIM overview, license requirements, configure Microsoft Entra role settings, assign Microsoft Entra roles in PIM, and activate Microsoft Entra roles.