Privileged Identity Management (PIM) & Conditional Access

Azure provides advanced security features to make sure sensitive roles and sign-ins are protected. Two of the most important are Privileged Identity Management (PIM) and Conditional Access. Both are available only in higher license tiers (mainly P2).

Privileged Identity Management (PIM)

• Manages who has elevated admin roles and when they can use them.
• Implements Just-In-Time (JIT) access → users request elevation when needed, instead of having permanent admin rights.
• Can require approval workflows before a role is activated.
• Provides auditing → logs who activated what role, and when.

Conditional Access

• Controls how and when users can sign in to apps/resources.
• Policies are based on signals like user risk, location, device, or app.
• Common rules: Require MFA, block legacy authentication, allow sign-in only from compliant devices.
• Applies at the authentication layer, not the resource layer.

Confusion Buster 🚨

PIM vs Conditional Access
– PIM = Manages roles (who can elevate to admin, when, and how).
– Conditional Access = Manages logins (under what conditions a user can sign in).
Exam trick: If the scenario is about temporary elevation → PIM. If it’s about MFA or device compliance → Conditional Access.

Simple Example

Bob is a Global Administrator. With PIM, his account doesn’t have permanent admin rights. When he needs to make changes, he requests elevation for 2 hours. Meanwhile, Sarah is a normal user — Conditional Access ensures she must pass MFA if logging in from outside the corporate network.

Exam Tip

Look for keywords: – “Just-in-time” → PIM. – “Require MFA / block risky logins” → Conditional Access.

What to Expect in the Exam

• Direct Q: “Which feature enforces MFA for all admins when signing in?” → Conditional Access.
• Scenario: “Admin needs temporary elevated access with approval.” → PIM.
• Trick Q: “Conditional Access can provide JIT access.” (False, that’s PIM).