How can I use Microsoft Entra Privileged Identity Management for User Access Administrator role?

Question

How can I use Microsoft Entra Privileged Identity Management for User Access Administrator role?

EnterpriseArchitect 6,166

I couldn't find the Entra ID or Azure AD section of this forum, so I am posting it here.

I need to monitor and audit any Global Administrator or user who can elevate themselves using https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-cli%2Centra-audit-logs#step-1-elevate-access-for-a-global-administrator-2

This Azure CLI:

az rest --method post --url "/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"

Because that is the only way to access the User Access Administrator role, which remains active despite the Azure Portal GUI disabling the Save button.

from this URL: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView/initialValue//tabId//recommendationResourceId//fromNav/Identity

How can I use Microsoft Entra Privileged Identity Management for User Access Administrator role?

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-22T08:32:21.2966667+00:00

Hi @EnterpriseArchitect

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-25T09:35:46.96+00:00

Hi @EnterpriseArchitect

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

2 answers

Your answer

Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-22T08:32:21.2966667+00:00

Hi @EnterpriseArchitect

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Praveen Chivarla 105 Reputation points Microsoft External Staff Moderator

2025-08-25T09:35:46.96+00:00

Hi @EnterpriseArchitect

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Welcome to the Microsoft Q&A Platform and thank you for your question!

Based on your descriptions, I would like to share a few steps that may help resolve the issue you are encountering.

Monitoring Elevation to User Access Administrator

1.Use Microsoft Entra Audit Logs

These logs capture when a user elevates privileges to the User Access Administrator role and when that access is removed. You can view this in the Microsoft Entra admin center or route logs to Azure Monitor for long-term retention

2.View Audit History in PIM

Go to: Microsoft Entra Admin Center → ID Governance → Privileged Identity Management → Microsoft Entra roles

Select Resource audit to see all activity associated with elevated roles.

Use My audit to view your own elevation history

3.Use Microsoft Sentinel for Advanced Monitoring Sentinel can ingest Microsoft Entra audit logs and alert on elevation events. This is useful for real-time monitoring and compliance

Using Microsoft Entra PIM for User Access Administrator Role

1.Enable PIM

Navigate to: Microsoft Entra Admin Center → Identity Governance → Privileged Identity Management

Enable PIM for Microsoft Entra roles

2.Assign Role as Eligible

Assign the User Access Administrator role as eligible, not permanent. This ensures users must activate the role when needed, reducing standing privileges

3.Configure Activation Settings

You can enforce Multi-Factor Authentication (MFA), Approval workflows, Justification prompts and Time-bound access

4.Audit and Access Reviews

Use access reviews to validate ongoing need for the role. You can assign reviewers and automate removal of unnecessary access

5.Power Platform Considerations

If you're working in environments like Dynamics 365 or Power Platform, elevation to System Administrator via PIM is required for certain tasks. Microsoft removes the elevated role automatically when the PIM assignment expires.

Please let me know how it goes. Wishing you a successful resolution and a great day!

Answer 2

Hi EnterpriseArchitect,

Thank you for posting your query on Microsoft Q&A.

As per our understanding, you want to use Microsoft Entra Privileged Identity Management (PIM) to manage and monitor the User Access Administrator role, especially focusing on auditing elevation and controlling just-in-time access.

In addition to Daphne Huynh, please check below additional information.

Enable Privileged Identity Management (PIM)

Confirm PIM is enabled for your tenant (requires Microsoft Entra ID P2 or equivalent license).
Navigate to Microsoft Entra Admin Center > Identity Governance > Privileged Identity Management to begin setup.

Assign the User Access Administrator Role via PIM

Assign users as Eligible (not permanent) for the User Access Administrator role under Azure resources (subscription or resource group scope).
This ensures they activate the role only when needed, reducing standing privileged access.

3__. Configure Activation Settings__

Enforce multi-factor authentication (MFA), approval workflow, justification prompts, and time-limited access for activation.
These settings add layers of security and accountability around role activation.

4__. Monitor and Audit Role Activations__

Use PIM’s Audit History and Resource audit to view role activation events.
Integrate Microsoft Entra audit logs with Microsoft Sentinel or another SIEM for real-time monitoring and alerting.

5__. Utilize Access Reviews__

Implement periodic access reviews in PIM to verify continued need and trigger automatic removal of unnecessary elevated privileges.

6__. Understand “Access Management for Azure Resources” Limitation__

The tenant-wide elevated access toggle (“Access management for Azure resources”) is outside PIM control and grants Global Administrators broad owner-like permissions across subscriptions.
This toggle’s management is separate from PIM assignments and can be controlled only through the Azure portal or Azure CLI.

7__. Using Azure CLI for Temporary Elevation__

You can elevate your access temporarily using commands like:

az rest --method post --url "/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"

Additional Recommendations:

Minimize tenant-wide elevated access where possible to improve security posture. Prefer scoped role assignments with PIM-managed just-in-time activation.
Assign roles at the least privilege scope necessary (resource group or subscription) rather than tenant-wide.
Set strict activation policies (MFA, approvals) to reduce risk of unauthorized elevation.
Leverage Microsoft Sentinel or third-party SIEM solutions to gain continuous visibility and alerts on role elevation activities.

Please refer to:

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Share via

How can I use Microsoft Entra Privileged Identity Management for User Access Administrator role?

2 answers

Your answer