PIM Manager documentation · Verified against PIM Manager 3.0.23.3 on Nov 3, 2026

Knowledge base

Step-by-step guides for the tasks you do most, short answers to the questions customers ask most, and what real tenants taught us about running privileged access at scale.

Admins and their lifecycle

Guide	Use it when
Onboard an admin	A person needs a separate admin account, named by your convention, with a Temporary Access Pass for the first sign-in.
Onboard a consultant	A consultant from another company needs an admin account, sponsored by one of your departments and confirmed by their employer.
Offboard an admin	An admin leaves and their account must be disabled on a date or at once, and their access removed.
Add a break-glass account	An emergency account must stay out of reach of every disable, revoke and offboarding action.

Delegate access

Guide	Use it when
Delegate an Azure landing zone or subscription	An Azure role at a management group, subscription or resource group must be reached through a PIM group.
Delegate Intune roles	An Intune role must be held by a PIM group instead of by people directly.
Delegate Defender XDR to a helpdesk	A helpdesk needs narrow Defender XDR response actions through a PIM group.
Delegate a Power BI workspace	A workspace role must be reached through a PIM group.
Find the least-privileged role	Someone asks for a broad role to do one task, and you want the narrowest role that allows it.
Use Discovery and gaps	You want a list of roles, subscriptions and workspaces nobody delegates yet, each with a ready proposal.

Activate

Guide	Use it when
Activate with the PIM Activator	An admin activates eligible roles and groups from the browser.
Install the PIM Activator without Intune	The machines that need the extension are not managed by Intune.

Control and review

Guide	Use it when
Read the access map	You must show who can reach a role, through which groups.
Handle drift	Someone changed an assignment outside PIM Manager and the tenant no longer matches your model.
Approve a held policy change	Policy choices you saved wait as a held change set for a SuperAdmin.
Enable access reviews	Each department must re-confirm its admins’ access on a fixed cycle.
Undo a commit	A committed change was wrong and must be taken back.

Hybrid and MSP

Guide	Use it when
Set up PIM for Active Directory	Membership of on-premises AD admin groups must follow PIM activations.
Roll a change to one wave	A managing tenant sends a change to a few managed tenants first.

Questions and lessons

FAQ: short answers about buying and running PIM Manager, role-assignable groups, nesting, drift and permissions, and the support cases that come up most often.
Lessons learned: problems we met in real tenants, why they are hard, and the rule PIM Manager follows because of them.
Glossary: the terms these pages use, such as desired state, drift, engine and reconcile.

More help

Day-to-day operation: Operate.
Every setting and script: Reference.
Contact: Support.

Verified against PIM Manager 3.0.23.3 on Nov 3, 2026Download PDF