SC-300 Step by step · Part 15

Admin Rights for 4 Hours Only: Set Up PIM With Approval

Make an admin role eligible, activated for four hours with MFA and a reason, approved by a manager, and removed automatically. Step by step.

8 November 2026 · 6 min read

PIM My roles: Helpdesk Administrator activated, with an end time four hours later — Watch the lesson: Part 15: Privileged Identity Management | SC-300 Step By Step

Alex covers the IT help desk on Fridays. On those days he needs Helpdesk Administrator. The rest of the week he should not have it, because a standing admin role is exactly what an attacker hopes to find on a stolen account.

Privileged Identity Management (PIM) solves this: the role is eligible, Alex activates it when he needs it, a manager approves, and it switches itself off. This is how we set it up in Part 15 of the SC-300 course.

Eligible vs active

Eligible: he can activate the role when needed, for a set time.
Active: he has it now. It can end on a date, or never.

Role settings control activation (maximum duration, MFA, justification, ticket number, approval), assignment (whether permanent is allowed and when eligibility expires) and notifications.

For Global Administrator and Privileged Role Administrator, always require approval.

Step 1: Set the rules for the role

ID Governance → Privileged Identity Management → Microsoft Entra roles → Roles, and open Helpdesk Administrator.
Role settings → Edit. Activation maximum duration: 4 hours, one shift. On activation, require Azure MFA. Keep justification on.

Edit role setting for Helpdesk Administrator: activation maximum duration 4 hours, justification required — Four hours at most, with a reason, every time.

Require approval to activate: yes, and select the approver: Megan Bowen, the operations manager. Update.

Role setting: Azure MFA on activation, require approval to activate ticked, one approver selected — Azure MFA on activation, and approval by one named approver.

Step 2: Make Alex eligible, not active

Add assignments, member Alex Wilber, assignment type eligible. Not permanently eligible: it ends, and someone must renew it.

Helpdesk Administrator assignments: Alex Wilber in eligible assignments — Today Alex has no help desk rights at all. On Friday he asks for them.

Step 3: Friday: request, approve, use

Alex opens PIM → My roles, finds the eligible role and selects Activate. Duration: four hours. Reason: covering the IT help desk, Friday shift.

Activate Helpdesk Administrator: duration 4 hours and the reason covering the IT help desk, Friday shift — A duration and a reason. The request now waits: Alex has nothing yet.

Megan opens Approve requests: Alex Wilber, Helpdesk Administrator, four hours, and his reason. She selects it, Approve, and records a justification: approved for the Friday shift.

Approve requests: Helpdesk Administrator activation requested by Alex Wilber, selected for approval — The approver sees who, which role, why, and for how long.

How you know it worked

Back in Alex’s My roles → Active assignments: Helpdesk Administrator, activated, ending four hours from now. He can reset passwords now; this evening he cannot, and nobody has to remember to remove it.

Active assignments: Helpdesk Administrator activated with an end time — Active, with an end time. The whole loop is in the audit history for the auditor.

What a tech lead should take away

Zero standing admin access is the goal: make every privileged role eligible, with a short activation and MFA.
Approval for the roles that can change everything, and a justification for all of them, so the audit trail explains itself.
Keep two emergency access accounts outside PIM and Conditional Access, protected and monitored, as the way back in.
PIM needs Entra ID P2 or ID Governance licences for the people who use it.

Do it yourself

Lab guides, practice and full mock exams come with a subscription. See the plans