Privileged Access
PIM Role Designer
Choose the admin roles your organisation uses and get recommended Privileged Identity Management settings for each one: whether it should be eligible or active, how long activation lasts, who approves it, and what authentication it needs.
Built on the Trust Level Framework: TL1 Strategic Control, TL2 Service Administration, TL3 Operational Administration and TL4 Workforce. Assurance — authentication, device, activation and oversight — scales with the impact of an identity being compromised. How authentication maps to each level.
Answer the questions, or load a read-only export of your tenant for an analysis of who holds each role today and a deployment script for the design. Nothing you enter or load leaves your browser.
Analyse your real tenant
RecommendedRun a read-only script against your tenant and load the result here. The designer then works from who actually holds each role and how PIM is configured today, rather than from your answers alone. The file is analysed in your browser and is never uploaded.
1. Download the script
Read-only. Uses Microsoft Graph PowerShell and makes no changes.
Export-PimData.ps12. Run it
Sign in as Global Reader when prompted.
.\Export-PimData.ps1Needs the module:
Install-Module Microsoft.Graph.Authentication. If Windows blocks the downloaded script, runUnblock-File .\Export-PimData.ps1first.3. Load the file
Drop pim-export.json here
or click to choose
Just exploring? or answer the questions below.
About this tool
How PIM Role Designer works
Pick the Entra ID admin roles your organisation uses and the designer recommends Privileged Identity Management settings for each: eligible or active, how long activation lasts, who approves it and what authentication it needs, scaled to the role's Trust Level.
To see who holds each role today, run the read-only export script and load its file; it's read in your browser and not uploaded. When you're happy with the design, download it as a CSV, or as a PowerShell script, Set-PimRoleSettings.ps1, that applies it.
Questions
Does it change my tenant?
No. The designer only produces files. Settings change when you run the script yourself, after reviewing it.
Is the role export uploaded anywhere?
No. The file is read and analysed in your browser.
Do I need an account?
No account is needed to design. Downloading the files needs a free andykemp.com account, which takes a minute to create.
Related tools
Use it with
- Break-glass Account BuilderDesign emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.
- Conditional Access Policy BuilderBuild a persona-based Conditional Access policy set around the Trust Levels, edit each policy visually, and export Graph JSON with a script that deploys it in report-only.
- Zero Trust ScorecardAssess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.