What is difference between Directly assigning the admin privilege and via PIM?

Question

What is difference between Directly assigning the admin privilege and via PIM?

Vinod Survase 4,776

For example: I assigned any admin access in M365 directly and another admin access via PIM so what would be difference in both and what are the benefits of each?

1 answer

Your answer

Answer 1

Vasil Michev 119.6K MVP Volunteer Moderator

Direct assignments are permanent and always active, meaning if an attacker manages to compromise your admin user, it gets access to everything (that the admin has access to). With PIM, you get Just in time activation, meaning an admin assignment is not always active, and you can configure additional conditions for activation, such as MFA, or manager approval, etc.

There is detailed documentation here: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

Vinod Survase 4,776 Reputation points

2023-08-31T16:35:18.3733333+00:00

Thanks Vasil Michev

I get it but what if I give admin access to an user on permanent basis via PIM, what does it do in the such cases? Does it prevent any bad actions or no?
Vasil Michev 119.6K Reputation points MVP Volunteer Moderator

2023-09-01T05:54:20.61+00:00

You can use PIM to have a permanently eligible assignment, so the user can activate it when needed. If you do go with a permanently assigned role instead, there is no big difference compared to direct assignment. The functionality is the same, however you do get more robust auditing and access review controls with PIM.
Sandeep G-MSFT 20,906 Reputation points Microsoft Employee Moderator

2023-09-05T10:47:09.3+00:00

@Vinod Survase

Just checking in to see if the above answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

Share via

What is difference between Directly assigning the admin privilege and via PIM?

1 answer

Your answer