Identity and data governance: privileged access, reviews, entitlement, lifecycle.
Which estates stop at role PIM, which need groups, which extend to Azure, and the list of problems you should stop trying to solve with this product. Plus what the rest of the Governance pillar has to pick up.
A quarterly recurring review of who is eligible for Global Administrator, with named reviewers and results that apply themselves. Includes denying a test assignment and proving it actually disappeared.
A just-in-time estate decays back into a standing one within a year, through exceptions that each seemed reasonable. The seven alerts, the reviews that actually remove access, and the two places this costs more than P2.
The same discipline over Azure RBAC, with a different administrative surface, a different API, a different set of people who can even see the assignments, and one operational tax: role settings here do not inherit down the scope tree.
PIM controls when privilege is held, not what privilege exists. Which assignments should exist at all, who can undo the controls you just built, and the two accounts deliberately left standing, permanent, and outside the entire machine.
Make a user who signed in with a password and a push touch a security key before they can become Global Administrator. Authentication context, the Conditional Access policy, the role setting, and the exclusion that would quietly remove the gate.
Requiring MFA on activation reuses the claim the session already carried, so it charged an attacker nothing. Since April 2026 an activation can demand a phishing-resistant credential, fresh, every time. The mechanism, and its three traps.
Build a role-assignable group carrying three directory roles, bring it under PIM, and make the administrators eligible for membership rather than in it. One activation grants the tier; two of the steps cannot be undone.
