Microsoft Entra PIM Just-in-Time Administration

Time-Bound Privileged Role Activation

A hands-on Microsoft lab demonstrating how permanent Global Administrator access can be replaced with eligible, approved and time-limited activation.

Lab environment: This project was completed independently in a personal Microsoft lab. All identities, devices and configuration details are lab data.

Project Summary

Area	Implementation
Business requirement	Reduce standing privileged access
Identity platform	Microsoft Entra ID
Privileged control	Privileged Identity Management
Activation controls	MFA, justification and approval
Privilege lifecycle	Eligible, active and automatically expired

Architecture

Scenario

Permanent Global Administrator access increases the impact of credential compromise and administrative mistakes. This project tested a just-in-time model in which privilege remains inactive until a controlled activation is approved.

What I Implemented

Eligibility and Activation

• Changed the administrator from permanently active to eligible
• Configured MFA for activation
• Required a business justification
• Required approver authorisation
• Set a time-bound activation period

Monitoring and Lifecycle

• Configured notifications for privileged-access events
• Submitted and approved an activation request
• Confirmed the account could perform an administrative action during the approved window
• Verified that the privileged role was automatically removed after expiry

Validation Results

Test	Expected result	Observed result
Before activation	Global Administrator permission unavailable	Unavailable
Request without required activation controls	Privilege not activated	Not activated
Approved request during activation window	Administrative action succeeds	Succeeded
After activation expires	Elevated permissions removed	Removed
Review notifications	Activation activity communicated	Notifications confirmed

Outcome

The lab validated the complete just-in-time privilege lifecycle from eligibility and controlled activation through temporary administrative use and automatic privilege removal.

Skills Demonstrated

• Microsoft Entra ID
• Privileged Identity Management
• Just-in-time administration
• MFA
• Approval workflows
• Role eligibility
• Time-bound access
• Privileged-access monitoring

Technical Documentation

View the full technical documentation (PDF)

---

Return to Guy Cheneval's GitHub profile