Entra ID PIM for Groups: Just-in-Time Group Membership for Privileged Access Control
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Standard PIM manages eligible assignments for specific Entra ID directory roles (Global Admin, Exchange Admin, etc.) and Azure RBAC roles. PIM for Groups extends this principle to group membership itself -- which is how access to most enterprise resources is controlled. If a SharePoint site, Teams workspace, Azure subscription, or line-of-business application is governed by group membership, PIM for Groups turns that access into JIT access without requiring a dedicated PIM integration for each resource. This is the scalable path to zero standing access across all resources.
Onboard a Group to PIM
Only cloud-only Entra ID groups (not AD-synced groups) can be onboarded to PIM. If you need JIT access for a resource controlled by an AD group, create a cloud-only wrapper group in Entra ID and nest it in the AD group (or reconfigure the resource to use the Entra ID group directly). Onboard a group: in the Entra admin center, navigate to Identity Governance > Privileged Identity Management > Groups. Click 'Discover groups' to see eligible groups. Select a group and click 'Manage'. Accept the PIM management notice. After onboarding, the group appears in the PIM Groups list. Navigate to the group > Assignments to set up eligible member assignments. Add eligible members: go to Assignments > Add assignments > select 'Member' role (not Owner). Choose the users who should have eligible (not permanent) membership. Set assignment duration (permanent eligible, or time-limited eligible). Optionally set activation requirements: MFA, justification, approval, and maximum activation duration.
Configure Activation Settings
Each PIM-managed group has configurable activation settings that apply when a user requests to activate their group membership. Configure via: PIM > Groups > [group name] > Settings > Member role settings. Key settings: Activation duration: how long the membership remains active after activation (1-8 hours for sensitive groups, up to 24 hours for less sensitive access). Require MFA on activation: Enabled -- ensures the activation request is from an authenticated session where MFA was completed. Require justification: Enabled -- user must provide a reason for activation (creates an audit trail and a brief thought-check before accessing sensitive resources). Require approval: optionally require a designated approver (group owner, manager, or named admin) before activation is granted. This is appropriate for the most sensitive groups (production database access, security tooling). Require ticket information: require an ITSM ticket number for each activation (useful for organizations with change management processes). For most groups, require MFA plus justification without approval -- this provides JIT access with low friction for the user while maintaining an audit log.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Use Cases: What to Put in PIM for Groups
PIM for Groups is most valuable for groups that control sensitive or privileged access where permanent membership is not justified. Ideal candidates: Azure RBAC role-assignable groups: groups assigned Contributor or higher on Azure subscriptions -- users should not have permanent Contributor access. Use PIM for Groups to make subscription access JIT. Application access groups: groups that control access to sensitive SaaS applications (CRM with all customer data, ERP, payroll). Activate when the user has a legitimate task, auto-expire after 8 hours. Security tool access groups: groups that allow access to SIEM dashboards, vulnerability management platforms, PAM vaults. Network infrastructure access groups: groups that provide access to firewall management, DNS administration, AD Sites and Services. Break glass groups: the break glass account groups can have permanent eligibility with instant activation (no approval, no MFA since break glass scenarios assume MFA is unavailable). Avoid PIM for Groups for daily productivity groups (email distribution lists, Teams chat channels, standard SharePoint sites used daily) -- the friction of daily activation defeats the purpose.
Monitor Group Membership Activations
PIM for Groups activations are logged in the Entra ID audit log. In the Entra admin center: Identity Governance > Privileged Identity Management > Audit history. Filter by 'Activate group membership' to see all activation events including: user, group activated, activation time, expiration time, justification provided, IP address. Forward to Sentinel: the Entra ID audit log is available via the Entra ID Connector in Sentinel. KQL for Sentinel: AuditLogs | where OperationName == 'Add member to group' | where InitiatedBy.user has 'PIM' | project TimeGenerated, TargetResources, InitiatedBy, ResultDescription. Alert on: activations during off-hours for sensitive groups (production DB access at 2 AM from an unexpected location), unusually high activation frequency for a single user, activation with the same justification string repeatedly (copy-paste justifications with no thought), and activations from IP addresses outside the expected corporate range.
Access Reviews for PIM Groups
Even with JIT access via PIM for Groups, the eligible assignments themselves need periodic review -- a user who changed roles six months ago may still be an eligible member of groups they no longer need. Configure Access Reviews for PIM Group eligible memberships: Identity Governance > Access Reviews > New Access Review > Groups and Teams > Select the PIM-managed groups > Review type: Members > Reviewers: group owners or managers > Frequency: quarterly. At end of review: auto-apply -- deny access removes the eligible assignment from users the reviewer did not recertify. Combined with JIT activation, this creates a two-layer access lifecycle: activation is JIT (so no standing access from day to day), and eligible assignments are reviewed quarterly (so stale eligibility is removed). This is the zero standing access model: users have no group membership until they activate it, and eligibility itself is reviewed and pruned regularly.
The bottom line
PIM for Groups extends JIT access to any resource governed by Entra ID group membership -- which is most enterprise resources. Onboard sensitive access groups (Azure subscription access, application access, security tooling) to PIM for Groups, configure activation with MFA and justification requirements, set activation durations to 8 hours or less, and run quarterly Access Reviews on eligible assignments. This achieves zero standing access for group-based resources without building dedicated PIM integrations for each application.
Frequently asked questions
Can PIM for Groups manage on-premises AD group membership for on-premises resources?
Not directly. PIM for Groups only manages cloud-only Entra ID groups. However, you can achieve hybrid coverage by creating a cloud-only Entra ID group in PIM for Groups and using Entra Connect to write the group membership back to on-premises AD (Group Writeback feature in Entra Connect). When a user activates their PIM group membership, the cloud-side group membership is written back to AD within the Entra Connect sync cycle (every 30 minutes by default), making the on-premises AD group membership active. The delay (up to 30 minutes) is a limitation for time-sensitive access scenarios.
What is the difference between PIM for Groups and Entitlement Management access packages?
Entitlement Management access packages manage the catalog of resources a user can request access to (groups, applications, SharePoint sites) and the approval workflow for initial access. PIM for Groups manages the JIT activation of existing group memberships. They complement each other: Entitlement Management is for initial access provisioning ('I need access to Project X resources -- submit a request'), PIM for Groups is for temporary elevation of existing eligible access ('I need to activate my eligible Project X group membership for this task'). Use both: Entitlement Management to govern who gets eligible assignments, PIM for Groups to enforce JIT activation of those assignments.
What happens to active group memberships when a PIM for Groups activation expires?
When the activation duration expires, PIM automatically removes the user from the active group membership. For cloud resources (applications, Azure RBAC), the access revocation propagates within minutes. For on-premises AD resources via Group Writeback, the removal propagates within the next Entra Connect sync cycle (up to 30 minutes). For applications that cache group membership (some applications cache tokens for up to 1 hour), the user may retain access until their cached token expires even after the PIM activation ends. Plan for this propagation delay in time-sensitive security scenarios.
Can a user have both a permanent and an eligible assignment to the same group?
Yes. A user can have a permanent (active) assignment and an eligible assignment to the same group simultaneously. The permanent assignment provides constant membership regardless of PIM activation. This configuration is not recommended for privileged groups -- the entire purpose of PIM for Groups is to eliminate permanent membership. If a user has a permanent assignment to a sensitive group, remove the permanent assignment and replace it with an eligible assignment only. Verify existing permanent memberships before enabling PIM for a group: the Assignments tab shows both permanent (Active) and eligible assignments.
How do I set up PIM for Groups activation alerts so the SOC is notified when someone elevates?
PIM sends built-in email notifications when a role or group activation occurs. Customize these in Entra ID PIM > Groups > [group] > Settings > Notifications: add your SOC's email distribution list as a notification recipient for 'Active assignment granted' and 'Eligible assignment activated'. For SIEM integration, PIM activation events appear in the Entra ID audit log with an operation name of 'Add member to group (PIM activation)' or similar -- forward the Entra audit log to your SIEM via Diagnostic Settings and alert on these activation events. For highest-privilege groups, also monitor the Entra ID activity log for administrative actions taken within 60 minutes of a PIM activation -- this correlates the activation with any sensitive changes made using the elevated access.
What is the difference between PIM for Groups versus PIM for Entra roles, and which provides stronger just-in-time access control?
PIM for Entra roles provides just-in-time activation for directory roles (Global Administrator, User Administrator, Privileged Role Administrator). PIM for Groups provides just-in-time group membership, which is the correct mechanism for controlling access to resources governed by group membership -- including on-premises AD groups synced via Entra Connect. The key distinction: Entra roles are coarse-grained (Global Admin has near-unlimited power), while PIM for Groups lets you create fine-grained access tiers by putting groups behind PIM. Example: a group that has Contributor access to a specific Azure subscription can be PIM-enabled, so engineers activate time-limited group membership to get that subscription access rather than having permanent Contributor assignment. PIM for Groups is also the only mechanism for applying PIM controls to on-premises AD groups (by managing membership in Entra ID for cloud-synced groups). Both mechanisms support approval workflows, MFA on activation, time-limited access, and audit trails. Organizations with complex RBAC requirements typically use both: PIM for Entra roles for directory administration tasks and PIM for Groups for resource-specific access tiers.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.