Entra PIM without P2: what Business Premium and E3 tenants can do about standing admins

What PIM does, in one paragraph

PIM manages, controls, and monitors access to Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 and Intune, across three surfaces: Entra roles, Azure resource roles, and PIM for Groups. An eligible assignment must be activated before the role can be used; an active assignment grants the privileges with no action required. Activation can require MFA, a justification, and an approver, and role holders can be put through access reviews with downloadable audit history. Microsoft is explicit that a permanent holder and an activated eligible holder get the same access; eligible users simply do not hold it all the time. Two limits matter here: PIM does not detect compromise or evaluate sign-in risk (that belongs to Entra ID Protection), and it manages roles and groups, not application API permissions, OAuth consent grants, or service principal credentials.

The licensing rule, sourced to Microsoft Learn

Microsoft's licensing fundamentals page and the PIM overview both state it: using PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses. Entra ID Governance is sold as six products that each contain the entitlement management, PIM, and access review capabilities that were in P2 plus additional governance features, and Microsoft Entra Suite includes all ID Governance features.

Who actually needs a license

The license is per person in three categories, not per employee: users with eligible or time-bound assignments to Entra or Azure roles managed through PIM, users with eligible or time-bound membership or ownership in PIM for Groups, and users who can approve or reject activation requests. Microsoft's own sizing example is 50 administrators with 42 managed through PIM, five approvers, and six non-admin reviewers, which requires 53 licenses. Licensing only your admin population is therefore a real option: a company with 3,000 employees and 25 administrators is sizing for the administrators, approvers, and reviewers, not the 3,000. Confirm the current wording on the licensing fundamentals page before you budget and check with your reseller; the old standalone PIM licensing page on Learn now returns a 404, so the terms do move. A Global Administrator with Entra ID P1 can also start a trial of Entra ID Governance from the admin center, but when a trial lapses eligible Entra role assignments are removed, so do not move your only administrators to eligible assignments without a plan for that day.

What P1 gives you and what only P2 adds

Available on P1 (Business Premium and E3):

• Conditional Access and administrative units. Microsoft lists them alongside custom roles, PIM, and entitlement management as five layered controls for fine-grained access governance, and says no single feature covers every scenario.
• Sign-in and audit logs retained for 30 days (Free tenants get 7), download of sign-in logs through Microsoft Graph, and streaming of sign-in and audit logs to Log Analytics. Each requires P1 or P2.
• Risky users and risky sign-ins reports with limited information: only medium and high risk users are shown, with no details drawer, risk history, or risk level.

Only with P2 (E5, P2 standalone, or Entra Suite):

• PIM, PIM for Groups, and PIM Conditional Access controls (also through Entra ID Governance).
• Risk-based Conditional Access. Microsoft states P2 is required to use risk-based access policies; its license table marks sign-in and user risk policies as No for P1.
• Premium risk detections with detail. Without P2, detections arrive titled "Additional risk detected" with no detection details, and the Graph sign-in fields riskDetail, riskLevelAggregated, and riskLevelDuringSignIn return "hidden".
• Risky sign-in retention of 90 days instead of 30.

Attack disruption is a separate line. Defender XDR attack disruption requires E5-tier or per-product Defender licensing; plain Microsoft 365 E3 without add-ons is not on the list. Business Premium qualifies through the Defender for Business it includes, which is designed for businesses up to 300 users. Either way, attack disruption fires on Microsoft's own high-confidence human-operated attack incidents; it is not a response policy your team authors.

A P1-only hardening checklist for one afternoon

None of these six items requires a PIM license. Each item is a Microsoft recommendation from the Entra roles best-practice pages, applied to a tenant that cannot make administrators eligible.

1. Dedicated, cloud-only admin accounts. Microsoft recommends cloud-native accounts for Entra role assignments and says to avoid on-premises synced accounts, because a compromised on-premises account can compromise Entra resources. Give each administrator a separate account that holds roles and nothing else.
2. Count and cut. Microsoft's best-practice list is to apply least privilege, turn on MFA for all administrator accounts, limit Global Administrators to fewer than five, and limit privileged role assignments to fewer than ten. Use Microsoft's least-privileged-role-by-task reference to move each admin from Global Administrator to the narrowest role that covers the job; our guide on how many Global Admins a Microsoft 365 tenant should have walks through the count.
3. Conditional Access scoped to directory roles. Microsoft states an account is 99.9% less likely to be compromised when MFA is used, and that MFA can be enforced on Entra roles through Conditional Access as well as PIM role settings. Build a policy that targets all directory roles, not only Global Administrator, and requires MFA. Run it in report-only mode first.
4. Two emergency access accounts, excluded from Conditional Access. Create two or more cloud-only emergency access accounts on the *.onmicrosoft.com domain, permanently assigned Global Administrator, with a passkey (FIDO2) or certificate-based method that differs from what your regular admins use. Exclude them only from Conditional Access policies that block or restrict sign-in, notify on every sign-in, and test them at least every 90 days. Microsoft's own reasons for these accounts include a PIM lockout, so they matter even more if you adopt PIM later. Full detail is in our break glass account guide.
5. Administrative units for scoped helpdesk roles. Use administrative units to scope Helpdesk Administrator, Password Administrator, and similar credential-changing roles to the users those staff actually support, so a compromised helpdesk account's reach stops there.
6. A monthly export of role assignments. Access reviews are a P2 and Governance capability, so on P1 the substitute is manual: once a month, export the members of every privileged role from the Entra admin center or the Microsoft Graph role management endpoints, compare with last month, and remove what is no longer needed. Include Azure. Entra roles and Azure roles are separate authorization systems, and a Global Administrator who has used elevate access holds User Access Administrator at the Azure root scope until someone removes it.

The gap the checklist does not close

Everything above reduces how many standing administrators you have and how easily one can be phished. None of it changes what happens in the hour after one is compromised. Microsoft is clear that an eligible assignment and a permanent one grant identical access once active, and that PIM does not detect compromise. At that moment a P1 tenant and a P2 tenant look more alike than the licensing debate suggests: the account holds real privileges, and someone has to take them away.

In a P1 tenant without a response layer, that someone is you, working by hand: disable the account, revoke sessions, reset the password, remove roles, then check Azure for a lingering root-scope elevation, because deactivating a Global Administrator assignment does not reset the elevate toggle. Each step is a separate portal action or Graph call. Nothing captures the before-state (which roles, group memberships, and Azure assignments the account held), so a wrong disable is hard to reverse cleanly. Nothing re-reads Microsoft to check the change took effect. And Entra sign-in and audit logs are retained for 30 days on P1, so the record of what you did and when will have aged out by the time an insurer or auditor asks, unless you routed it elsewhere. We cover the manual sequence in what to do when an Entra admin account is compromised and the ordering question in revoke sessions vs disable user.

That is the privileged identity response gap. PIM governs who holds a role and for how long. Neither PIM nor the P1 checklist above governs the response when a role holder is compromised, captures the evidence, or verifies the outcome. If you can license your administrator population for P2 or Entra ID Governance, do it; PIM is Microsoft's recommendation and nothing here argues against it. If you cannot this year, run the checklist this week, then decide separately how your team will respond when a standing administrator is compromised, because that decision does not depend on the license.

Sources

• Microsoft Entra ID Governance licensing fundamentals (P1 in Business Premium and E3, P2 in E5, who needs a PIM license, the sizing example, Governance and Entra Suite contents, license lapse behavior). Checked September 2026.
• What is Microsoft Entra Privileged Identity Management (what PIM does, eligible versus active, license requirement, what PIM does not cover). Checked September 2026.
• Best practices for Microsoft Entra roles (cloud-native admin accounts, MFA via Conditional Access, the five layered controls, recurring reviews). Checked September 2026.
• Privileged roles and permissions in Microsoft Entra ID (fewer than five Global Administrators, fewer than ten privileged role assignments). Checked September 2026.
• Manage emergency access admin accounts (two or more accounts, cloud-only, permanent Global Administrator, passkey or certificate, Conditional Access exclusion, 90-day validation, PIM lockout). Checked September 2026.
• Elevate access to manage all Azure subscriptions and management groups (Entra and Azure roles are separate, root-scope User Access Administrator, PIM deactivation does not reset the toggle). Checked September 2026.
• What is Microsoft Entra ID Protection (P2 requirement, what Free and P1 tenants see in the risk reports). Checked September 2026.
• Risk-based access policies (P2 required for risk-based Conditional Access). Checked September 2026.
• What are risk detections ("Additional risk detected" without P2). Checked September 2026.
• signIn resource type (Microsoft Graph v1.0) (P1 or P2 required to download sign-in logs; risk fields return "hidden" without P2). Checked September 2026.
• Microsoft Entra data retention (30 days of sign-in and audit logs on P1 and P2, 7 on Free, risky sign-ins 90 days on P2). Checked September 2026.
• Analyze activity logs with Log Analytics (streaming to Log Analytics requires P1 or P2). Checked September 2026.
• Configure attack disruption in Microsoft Defender XDR (licensing list; plain E3 not included). Checked September 2026.
• What is Microsoft Defender for Business (included in Business Premium, designed for up to 300 users, includes attack disruption). Checked September 2026.