CMMC Level 2 Entra PIM Setup For Admin Roles 2026 Guide

Standing admin access is like leaving the master keys on the front counter. Most days nothing happens. Then one bad password reset, one phish, or one stolen session cookie turns into a long week.

A solid Entra PIM setup gives me a practical way to control admin roles with just-in-time access, approvals, and logs. It also makes my environment easier to explain during a CMMC Level 2 conversation because I can show who elevated, why, and for how long.

Below is the hands-on approach I use for small businesses that need tighter admin control without slowing the team down.

Before I configure PIM, I set the ground rules (licenses, roles, break-glass)

First, I confirm licensing. Microsoft Entra Privileged Identity Management requires the right Entra plan (commonly Entra ID P2 or the governance bundle). Next, I decide who can administer PIM. I keep that group tiny and assign Privileged Role Administrator (not Global Administrator) whenever possible.

Then I list the admin roles that matter in my tenant. For most SMBs, that’s Global Administrator, Privileged Authentication Administrator, Exchange Administrator, SharePoint Administrator, Intune Administrator, and Security Administrator. If you use Azure, include subscription roles too, but that’s a separate PIM track.

Break-glass accounts come next. I create two emergency accounts that can sign in even if Conditional Access breaks. I store credentials securely, alert on any sign-in, and I don’t use them for daily work.

Most clients ask for this as part of our Small Business IT work, alongside Cloud Infrastructure, Office 365 Migration, and Data Center Technology projects. If you run a restaurant, it pairs well with Restaurant POS Support and Kitchen Technology Solutions, because admin accounts touch those systems too. I bundle it with Cybersecurity Services, Endpoint Security, and Device Hardening, then maintain it through Innovative IT Solutions, Tailored Technology Services, and Cloud Management. That’s how I show up as a Business Technology Partner through Technology Consulting, Infrastructure Optimization, and Digital Transformation. In practice, it becomes the backbone of my IT Strategy for SMBs, Secure Cloud Architecture, Managed IT for Small Business, and Business Continuity & Security.

Gotcha: If you keep a standing Global Admin “just in case,” PIM won’t fix that risk. Convert it to eligible, and test your emergency process.

Step-by-step Entra PIM setup in the Entra portal (admin roles)

I do this work in the Microsoft Entra admin center. If you want Microsoft’s reference steps for role assignment screens, I keep Assign Entra roles in PIM open in another tab.

1. Open PIM: Sign in to the Entra admin center, then go to Identity governance and open Privileged Identity Management.
2. Choose scope: Select Microsoft Entra roles, then open Roles.
3. Pick the admin role: Start with Global Administrator, then work down your list.
4. Edit role settings: Open the role, go to Settings, and choose Edit (Microsoft documents the options in Configure Entra role settings in PIM).
5. Set activation requirements (recommended defaults):
   • Require MFA on activation
   • Require justification
   • Require ticket information (if you use a ticket system)
   • Set Activation maximum duration to 1 hour for Global Admin, 2 hours for most admin roles
6. Require approval for high-impact roles: For Global Administrator and Privileged Authentication Administrator, I turn on approval and set two approvers (primary and backup). If you only have one IT lead, use an owner plus a second executive for emergency oversight.
7. Configure assignment rules: I allow Eligible assignments for admins, and I avoid Permanent unless it’s break-glass. I also set an assignment expiration (for example, 90 or 180 days) so I’m forced to revisit access.
8. Add eligible assignments: In the role view, open Assignments and add users or groups as Eligible. I prefer groups because it reduces one-off admin sprawl.
9. Turn on notifications: Enable alerts for new eligible assignments, permanent assignments, and role activations. Route them to a shared security mailbox.
10. Test the flow: I sign in as an admin, activate the role, and confirm the approval request, MFA prompt, and log entries appear.

Secure defaults I recommend for admin activations (so it’s tight, but usable)

PIM settings should match the blast radius of the role. Here’s the baseline I use for CUI-adjacent tenants, then I tune it based on staffing and tools.

Admin role (example)	Activation max duration	Approval required	On-activation requirements
Global Administrator	1 hour	Yes (2 approvers)	MFA, justification, ticket
Privileged Authentication Administrator	1 hour	Yes (2 approvers)	MFA, justification, ticket
Security Administrator	2 hours	Often yes	MFA, justification
Exchange Administrator	2 hours	Sometimes	MFA, justification
Intune Administrator	4 hours	Sometimes	MFA, justification

The takeaway: I keep durations short and approvals reserved for roles that can change identity, MFA, or tenant-wide settings. When someone complains about friction, I don’t extend durations first. Instead, I check whether the admin workflow needs better tooling or a better runbook.

CMMC Level 2 alignment: how PIM supports least privilege and auditability

CMMC Level 2 maps to NIST SP 800-171 expectations. PIM doesn’t “make you compliant,” but it helps me demonstrate control in a few important areas.

Least privilege improves because admins don’t hold powerful roles all day. They elevate when needed, then drop back automatically. That supports the spirit of limiting privileged functions.

Account management gets easier to explain because eligible assignments are explicit, time-bound, and reviewable. If someone changes roles, I update one group membership and the PIM chain stays intact.

Auditability is where PIM shines. Activations create a trail: requester, approver, time, and justification. Pair that with Entra audit logs and you get a story an assessor can follow.

Incident response expectations improve when I can quickly answer, “Who had admin rights at 2:17 AM?” Access reviews also matter here. I schedule recurring reviews of privileged assignments, then remove access that isn’t justified. If you want a walk-through on the review mechanics, this guide on PIM access reviews for privileged roles is a useful companion.

Evidence to collect for assessors (plus common pitfalls I fix fast)

When I’m preparing for a review, I collect evidence as I build. That saves time later.

• Screenshots or exports of PIM role settings per admin role (activation duration, approval, MFA, notifications)
• Screenshots of Eligible vs Active assignments for each privileged role
• Role activation logs showing approvals, justifications, and time bounds
• Access review configuration and review results (completed reviews, removals, and sign-offs)
• Relevant Conditional Access policies (export or screenshots) that backstop privileged sign-ins

Common pitfalls I see, and how I remediate them:

• Legacy per-user MFA: I move the tenant to Conditional Access for consistent enforcement, then confirm PIM activation also requires MFA.
• Standing Global Admin: I convert daily admins to eligible and leave only break-glass as permanent (with monitoring).
• Missing break-glass: I add two emergency accounts, test sign-in, then alert on any use.
• Overly long activation windows: I bring them down to 1 to 4 hours, and I rely on re-activation when needed.
• No approvers for high-impact roles: I assign two approvers and document who covers vacations.

For deeper context on just-in-time patterns, I also reference configuring Entra PIM for just-in-time admin access when I’m training internal owners.

Conclusion

When I implement PIM the right way, admin access becomes temporary, reviewed, and easy to explain. That combination supports least privilege and stronger auditing, which matters in CMMC Level 2 discussions. If you want help tailoring approvals, Conditional Access, and evidence collection to your environment, I’m happy to map it to your people, your tools, and your risk tolerance.