PIM Manager documentation · Verified against PIM Manager 3.0.23.3 on Nov 3, 2026
Features
Privileged access in Microsoft Entra ID and Azure drifts: roles are granted by hand, groups pile up, and nobody can say what the access should be. PIM Manager keeps one desired state for your admins, groups, roles and policies, applies it, and shows every difference.
What PIM Manager does
You define admin accounts, delegation groups, role assignments and PIM policies once. The engine compares them with the live tenant and creates, updates or removes exactly what differs. It touches only the objects you defined. Every change you make to the model is staged and reviewed, and the engine applies what you committed. Safety guards hold a run that would remove, disable or weaken too much. The few changes that happen on a schedule are listed in Change control.
Feature areas
| Area | What you get |
|---|---|
| Delegation model | One desired state, the access map, role lookup, nested groups, workload roles |
| Change control | Pending changes, backups and undo, approvals, policy settings, safety guards |
| Admin accounts | The admin lifecycle, Temporary Access Passes, offboarding, access requests, consultants |
| Visibility and evidence | Drift, standing access, discovery and gaps, reports, audit trail, jobs and alerts |
| Integrations | On-premises Active Directory, the access request API, the MCP server, managing and managed tenants, the PIM Activator |
| Platform and editions | Runs in your own Azure, settings and feature switches, editions and license, updates, support |
Editions
The Community edition is free for a single tenant. It covers Entra ID roles, PIM for Groups, administrative units, Azure roles, Intune and Defender XDR roles, staged changes, the admin lifecycle, policy templates, drift, reports, the audit trail, alerts and break-glass protection. Pro Business and Pro Enterprise add governance features and the advanced integrations. Pro MSP adds managing and managed tenants. Each feature page says when a feature is not in every edition, and Platform and editions compares them. In the product, a Pro capability on a Community installation is shown, labeled and explained.
Prices are on invardia.com/pricing.
Where to go next
- How to design your model: design.
- How the product protects itself and your tenant: security-design.
- What runs where: architecture.
Verified against PIM Manager 3.0.23.3 on Nov 3, 2026Download PDF