PIM Manager documentation · Verified against PIM Manager 3.0.23.3 on Nov 3, 2026

Glossary

PIM Manager places each delegation by tier, level and plane. This page explains those terms and the shared terms you meet across the docs. If you also use SecurityInsight, which uses “tier” for a different job, Compared with SecurityInsight shows how its tiers line up.

Tier

In PIM Manager, a tier is one of three zones of the Microsoft Enterprise Access Model:

Tier	What it holds	Plane codes
T0	Control of the identity system itself: global roles and services such as Conditional Access.	CP
T1	Administration of workloads, data and the management platform (logging, security, connectivity).	WDP, MP
T2	Access to applications and data as a user or an integration.	APP, USER

Level

In PIM Manager, a level is a number from L0 to L9 inside the tier, and a higher number means a narrower delegation.

Level	Typical content
L0	The roles that can make anyone Global Administrator: Global Administrator, Privileged Role Administrator and Privileged Authentication Administrator.
L1	Broad administration: for Entra ID, the other tenant-wide directory roles.
L2	Scoped administration, for example a directory role limited to one administrative unit.
L3 to L9	Workload roles in each service’s own role model (Intune, Defender XDR, Power BI, Azure and more).

For workload roles, PIM Manager suggests administrators at L3, operators and contributors at L4 and readers at L5. Defender XDR is one step higher: operators at L3 and readers at L4.

For Azure, the level follows the Cloud Adoption Framework management-group layer of the scope:

Azure scope	Level
Tenant Root Group	L3
Intermediate root	L4
Platform / Landing zones	L5
Corp / Online / Management	L6
A subscription	its management group + 1
A resource group	its subscription + 1
A resource	its resource group + 1

The level never goes above L9. When PIM Manager cannot see where a scope sits in the management-group tree, it uses the role rule and says so in the preview. Two paths propose Azure levels differently (Delegate a permission, and Discovery and gaps); tiers and levels says how.

Plane

A plane tells you which part of a tier a group lives in. PIM Manager writes two plane markers into each group name (naming):

Access plane (Enterprise Access Model): CP control plane (T0), MP management plane and WDP workload and data plane (T1), APP app access and USER user access (T2).
Target domain: ID identity (Entra roles, Intune roles), RES resources (Azure roles on management groups, subscriptions and resource groups) and DAT data (for example Power BI content or SharePoint sites).

An example name is PIM-Entra-ID-AppAdmin-L1-T0-CP-ID: an Entra role at level L1, tier T0, control plane, identity domain.

Shared terms

Term	Meaning
Eligible	The user may activate a role or group membership when needed but holds no rights until they do.
Active	The rights are in effect, either for a time-limited activation or as a standing assignment.
Activation	The time-limited step that turns an eligible assignment into an active one, with the justification, MFA or approval the policy requires; see the PIM Activator.
PIM for Groups	Microsoft Entra Privileged Identity Management applied to group membership, so that joining a group is eligible and time-bound.
Permission group	A group that holds the actual role or permission on its target, for example one Entra role or one Azure role at one scope.
Role group	A group for a job function (a team, a process or a department) that nests into the permission groups that job needs; administrators join role groups, not permission groups. See nested groups.
Nesting	Placing a role group inside permission groups, so one membership change adds or removes all the access of a job.
Role-assignable group	An Entra group that can hold an Entra directory role; the flag is set only when the group is created, a tenant can have at most 500, and a membership in one through PIM nesting can only be Eligible. See role-assignable groups.
PIM v1, PIM v2	Names for two ways of using Microsoft Entra PIM, not Microsoft products or versions. PIM v1 makes each person eligible for each role directly; PIM v2 makes a person eligible for a role group that nests permission groups. See Why PIM Manager.
Engine	The scheduled job in your Azure subscription that applies your model to the tenant, as its own managed identity. The Manager stages and commits changes; the engine writes them.
Desired state	The access you define in PIM Manager’s definitions; PIM Manager touches only what you define, and an empty definition means it changes nothing.
Reconcile	One engine pass that compares the desired state with the tenant and creates or updates what differs. The daily reconcile also removes access PIM Manager put in place whose definition a commit later removed, unless a SuperAdmin set it to report only.
Drift	A difference between the desired state and what is actually in the tenant, for example a membership someone added by hand.
Guard	A stop that holds a change whose damage would not fix itself, such as a policy change, many removals in one run or the removal of the last Global Administrator, until a SuperAdmin releases it. See guards.
Maker-checker	One administrator (the maker) stages a sensitive change and a different administrator (the checker) must approve it so that it commits. Available in Pro editions; not in Community. The one exception is Allow an administrator to approve their own requests under Settings > Approvals & policy: it is off by default and only a SuperAdmin can switch it on. A PIM policy change set is not covered: any SuperAdmin approves it, including the one who saved the choices (see How to approve a held policy change). Maker-checker is separate from the Second approver setting on Pending changes (off by default), which makes a different administrator commit a sensitive change, or every change, without an approval request.
Offboarding	Ending an admin’s access. By default the account is disabled on its auto-disable date; sign-in sessions are revoked and memberships removed only with Automatic offboarding, which is off by default. See How to offboard an admin.
Break-glass account	An emergency account kept outside normal controls for when sign-in or PIM fails; PIM Manager does not disable, revoke or offboard an account on its break-glass list.
Access review	A campaign in which owners confirm or remove each member’s access, with the decisions recorded and enforced. See access reviews. Available in Pro editions; not in Community.
Administrative unit	An Entra container that limits a directory role to a subset of users, groups or devices; a role scoped this way sits at L2.
Management group	An Azure container above subscriptions that passes policy and role assignments down to everything below it.
Landing zone	A management group (and the subscriptions under it) prepared by the Cloud Adoption Framework for application workloads, such as Corp or Online.

Compared with SecurityInsight

You run into the same problem in every review: one team says “this account is Tier 0”, another team says “that group is T1”, and both are right. They answer different questions.

SecurityInsight rates exposure. It looks at what an asset or an identity can actually do (its Entra roles, API permissions, Azure role assignments and AD group memberships) and gives it a Tier 0 to Tier 3 rating on an attacker-centric scale. Tier 0 means one step to full compromise; Tier 3 means low blast radius. The rating is measured, not chosen.
PIM Manager places a delegation. It decides where a permission group or a role group sits in your access design, using the Microsoft Enterprise Access Model tiers T0, T1 and T2 plus a level from L0 to L9. The placement is part of the design you choose, and it is written into the group name.

So a SecurityInsight tier describes risk you have; a PIM Manager tier describes where you put access. Use SecurityInsight to find identities whose real exposure is higher than their design intends, and use PIM Manager to move that access into the right group, tier and level.

SecurityInsight tiers

In SecurityInsight, a tier is a rating from 0 to 3:

Tier	Meaning
Tier 0	One-step compromise of the identity plane or the tenant.
Tier 1	A privilege-escalation path that takes a few steps.
Tier 2	Impact on a workload or its data, with no direct path to the identity plane.
Tier 3	A standard account with no escalation path.

SecurityInsight gives an identity the most privileged tier found across all its permissions. When nothing gives a tier, the default rule as shipped rates the identity Tier 3.

SecurityInsight has no equivalent of PIM Manager’s L0-L9 levels. It marks only whether a Tier 0 Entra role is tenant-wide (level 1) or scoped to an administrative unit or one object (level 2).

SecurityInsight uses “identity plane” in its tier definitions in the same sense as the control plane: the systems that decide who is who and who may do what.

How the tiers line up

The two scales overlap but do not match one to one. Read each row as “an identity SecurityInsight rates like this is typically delegated through a PIM Manager group placed like this”. The SecurityInsight tiers quoted here are as shipped; your own SecurityInsight catalog can change any of them.

SecurityInsight	Examples (as shipped)	Typical PIM Manager placement	Where they differ
Tier 0	Global Administrator, Privileged Role Administrator, Domain Admins, Owner or User Access Administrator on a management group	T0, plane CP, at L0 (Global Administrator, Privileged Role Administrator) or L1 (other tenant-wide roles)	Azure Owner on a management group is Tier 0 in SecurityInsight, but PIM Manager places Azure roles in T1 (resource domain) at L3 to L6. SecurityInsight rates every management group Tier 0, at any depth, and sees a management-group assignment through the subscriptions below it. Treat those groups with T0 care even though their name says T1.
Tier 1	Helpdesk Administrator, Backup Operators, Server Operators, Owner on one subscription	T0 at L1 (tenant-wide Entra role) or L2 (scoped to an administrative unit); T1 at about L7 for Owner on a subscription	Helpdesk Administrator is an escalation path (Tier 1) in SecurityInsight, while PIM Manager treats every tenant-wide Entra role as T0.
Tier 2	User Administrator, Intune Administrator, Contributor on a subscription or resource group, DnsAdmins	T0 at L1 for Entra directory roles; T1 at L3 to L9 for workload roles and Azure Contributor	The biggest gap: SecurityInsight rates User Administrator and Intune Administrator Tier 2 as shipped, because they have no direct identity-plane path, but as Entra directory roles PIM Manager places them in T0.
Tier 3	Standard users, Reader, Reports Reader, Global Reader	T2 (APP or USER) for end-user and integration access; T1 at L5 for workload readers	Global Reader is a tenant-wide Entra role, so PIM Manager places it in T0 at L1 although SecurityInsight rates it Tier 3 as shipped.

Three rules of thumb:

The PIM Manager tier should not be lower risk than the SecurityInsight rating of what the group grants. If a T1 group grants something SecurityInsight rates Tier 0, review the group.
Scope narrows both. SecurityInsight lowers an Azure role’s rating as the scope narrows: Owner, Tier 0 as shipped, is Tier 0 on a management group, Tier 1 on a subscription, Tier 2 on a resource group and Tier 3 on one resource. PIM Manager raises the level the same way.
Eligible Entra roles count. SecurityInsight counts an eligible Entra role the same as an active one: an eligible Global Administrator is a Tier 0 identity. It follows PIM for Groups from a group that holds an Entra role. For Azure it counts active role assignments only, so an eligible Azure role is not part of the rating.

SecurityInsight terms

Term	Meaning
Criticality tier	SecurityInsight’s Tier 0 to Tier 3 rating of how bad it is if one asset or identity is compromised.
Crown jewel	SecurityInsight’s name for a Tier 0 asset, such as a domain controller or a Global Administrator account.

Verified against PIM Manager 3.0.23.3 on Nov 3, 2026Download PDF