Skip to content
AKAndy KempTools

Privileged Access

PIM Role Designer

Choose the admin roles your organisation uses and get recommended Privileged Identity Management settings for each one: whether it should be eligible or active, how long activation lasts, who approves it, and what authentication it needs.

Built on the Trust Level Framework: TL1 Strategic Control, TL2 Service Administration, TL3 Operational Administration and TL4 Workforce. Assurance — authentication, device, activation and oversight — scales with the impact of an identity being compromised. How authentication maps to each level.

Answer the questions, or load a read-only export of your tenant for an analysis of who holds each role today and a deployment script for the design. Nothing you enter or load leaves your browser.

Analyse your real tenant

Recommended

Run a read-only script against your tenant and load the result here. The designer then works from who actually holds each role and how PIM is configured today, rather than from your answers alone. The file is analysed in your browser and is never uploaded.

  1. 1. Download the script

    Read-only. Uses Microsoft Graph PowerShell and makes no changes.

    Export-PimData.ps1

  2. 2. Run it

    Sign in as Global Reader when prompted.

    .\Export-PimData.ps1

    Needs the module: Install-Module Microsoft.Graph.Authentication. If Windows blocks the downloaded script, run Unblock-File .\Export-PimData.ps1 first.

  3. 3. Load the file

    Drop pim-export.json here

    or click to choose

Just exploring? or answer the questions below.

Your tenant

These answers adjust the settings recommended for every role.

PIM needs P2 or Entra ID Governance.

TL1 calls for a dedicated FIDO2 key; TL2 and TL3 at least a device-bound passkey.

TL1: dedicated PAW or Windows 365 Cloud PC. TL2: Windows 365 or shared AVD. TL3: hardened managed device.

If yes, PIM can require a ticket number on activation.

Roles you use

Tick each role your admins need and, if you know it, how many people need it. Roles are placed by what the identity could do if compromised — move a ticked role to another Trust Level if your context calls for it.

TL1 Strategic Control
TL1

Strategic Control

Identities that control the control plane itself. A compromise here could mean complete loss of control of the tenant.

Authentication: Dedicated FIDO2 security key. Admin environment: Dedicated physical PAW or dedicated Windows 365 Cloud PC.

TL2 Service Administration
TL2

Service Administration

Administrators of critical workloads. Significant impact, but within a defined service boundary rather than the tenant itself.

Authentication: Dedicated FIDO2 security key preferred; device-bound passkey where justified. Admin environment: Windows 365 or shared Azure Virtual Desktop.

TL3 Operational Administration
TL3

Operational Administration

Routine operational administration — helpdesk, user support and service desk teams.

Authentication: Device-bound phish-resistant passkey; FIDO2 where appropriate. Admin environment: Hardened, managed device.

TL4

Workforce

Standard users with no admin roles. They share the same platform as everyone above, so they still need modern authentication, device compliance and Zero Trust protections. No admin roles to configure here — every admin also has a TL4 identity, which should never hold a role.