IAM vs PAM vs PIM, and Where Entra PIM Stops

For anyone who has been asked whether they need a PAM tool when they already pay for Entra ID P2: what IAM, PAM and PIM each cover, where Microsoft's PIM stops, and what's left standing in a hybrid tenant or across an MSP's clients.

IAM (identity and access management) governs every identity and what it can reach. PAM (privileged access management) is the part of IAM that controls the accounts that can change systems: finding them, storing and rotating their credentials, granting them only when needed and logging their use. PIM (privileged identity management) makes privileged roles eligible instead of permanent. In a Microsoft shop, PIM usually means a product, Microsoft Entra PIM, and it does that job for Microsoft cloud roles only.

How this page was made: every Microsoft statement is quoted from Microsoft Learn or Partner Center, checked on 21 October 2026 and linked at the end. CyberQP makes Panthera, a privileged access management platform; where it fits is stated in one section, near the end.

IAM, PAM and PIM in one list

The three overlap, so the clearest way to separate them is by the question each one answers.

• IAM: who is this, and what can they reach? Every user, device and app: sign-in, single sign-on, MFA, groups, provisioning and deprovisioning. Microsoft Entra ID is the IAM system for most Microsoft 365 tenants.
• PAM: who can change things, with which credentials, and when? The accounts with admin rights: domain admins, Global Administrators, local administrator accounts, service accounts and the shared credentials technicians type. Typical controls: discovery, a vault, credential rotation, just-in-time access, elevation on endpoints, and an audit trail.
• PIM: who holds a privileged role, and for how long? Role assignments that are eligible rather than active, activated on request with approval, MFA and a justification, and expiring on their own. Entra PIM is Microsoft's implementation.

NIST defines a privileged user as one "authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform". PAM covers those users and the accounts they use; IAM covers everyone.

Is Microsoft PIM a PAM?

It does part of PAM's job, for part of the estate. Microsoft describes PIM as a service to "manage, control, and monitor access" to "resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune". Inside that scope it is good: just-in-time activation, time-bound assignments, approval, MFA on activation, justification, notifications, access reviews and audit history.

Outside that scope it has nothing to manage. PIM controls who holds a role; it doesn't store or rotate the password of the account that holds it, and it doesn't reach systems that aren't Microsoft cloud services.

Where Entra PIM stops

Each line below comes from Microsoft's own documentation, or from what that documentation leaves out of scope.

• Microsoft cloud only. PIM manages access to Entra ID, Azure and other Microsoft Online Services. Local Windows administrator accounts, on-premises Active Directory and Google Workspace are outside it.
• No on-premises groups. PIM for Groups grants just-in-time membership of Entra groups, but Microsoft excludes "dynamic membership groups and groups synchronized from on-premises environment". In a hybrid tenant, Domain Admins in AD is not a group PIM can make just-in-time.
• Roles, not credentials. PIM activates a role on an account that already exists. The account's password, and every shared, service or break-glass credential, still has to be stored, restricted and rotated somewhere else.
• Not on endpoints. Local admin rights on Windows machines, and elevation for a single application, are a different control. Microsoft sells that separately as Intune Endpoint Privilege Management, alongside Windows LAPS for the local administrator password.
• Licensed per user. "You need either Microsoft Entra ID Governance licenses or Microsoft Entra ID P2 licenses to use PIM and all of its settings."

For an organization that is fully cloud, Microsoft-only and passwordless, Entra PIM may be most of what it needs. Most mid-market tenants still have an on-premises domain, a few service accounts and local admin accounts on every machine.

The MSP version: GDAP plus PIM for Groups

An MSP reaches client tenants through GDAP (granular delegated admin privileges), which Microsoft says gives partners "least-privileged access following the Zero Trust cybersecurity protocol" with "granular and time-bound access" to customers' workloads. The Partner Center page doesn't mention PIM, and there's a limit of 100 security groups per customer.

The best native setup combines the two: technician security groups in the partner tenant, made eligible through PIM for Groups, assigned to each client's GDAP relationship, and activated with MFA and a justification when a technician needs them. T-Minus365's write-up walks through it and notes the PIM license needed in the partner tenant. It is worth doing, and it makes Microsoft role access just-in-time across every client.

What it leaves standing on each client:

• local administrator accounts on every endpoint and server;
• domain admin and other on-premises AD credentials;
• the break-glass accounts Microsoft says to keep as permanent Global Administrators (see break-glass accounts, tenant by tenant);
• service accounts and the passwords technicians keep in the PSA or the documentation platform;
• any client on Google Workspace instead of Microsoft 365.

The eight-phase check: what Entra PIM covers

Zero standing privilege takes eight phases, walked through in zero standing privilege: the PAM journey for MSPs. Here is where Entra PIM does the work and where it doesn't.

1. Discover and assess: PIM manages the Entra and Azure role assignments it holds. It doesn't look for local admin accounts, AD groups or Google Workspace admins.
2. Remediate: PIM can convert a permanent Entra role assignment to eligible. Removing accounts from on-premises or local admin groups is outside it.
3. Vault: not in PIM's scope.
4. Rotate: not in PIM's scope. Windows LAPS rotates the local administrator password on each device.
5. MFA and secure access: PIM can require MFA to activate a role.
6. Just-in-time access: PIM's core job, for Microsoft cloud roles and cloud-only groups.
7. Audit, monitor and alert: PIM keeps audit history and sends notifications for role activations.
8. Endpoint privilege: not in PIM's scope; that's Intune Endpoint Privilege Management, licensed separately.

Read it as three phases PIM handles well for Microsoft cloud roles, two it covers only for Entra roles, and three it leaves to something else.

Using Entra PIM and a PAM platform together

Keep Entra PIM for Microsoft cloud roles if you already pay for P2; it does that job well and it's built into the tenant. Put everything PIM can't see under a PAM platform: the discovery across every source, the credentials, the endpoints and the non-Microsoft systems. The question to ask any PAM vendor is what it covers that PIM doesn't, and for an MSP, whether it does that for each client separately.

That's the gap Panthera is built for:

• Discovery: continuously finds every privileged identity in each client, from admin accounts to end users with hidden admin rights, service accounts, identities used by AI agents and break-glass accounts.
• Remediation: removes accounts from privileged groups or disables them at the source.
• Vault and rotation: a zero-knowledge vault that restricts each credential to authorized technicians and logs who accessed it, with rotation on demand or on a schedule, without the secret leaving the vault.
• Just-in-time access: dedicated technician accounts that are disabled by default and enabled for a task, with an optional second approval, then switched off again. PIM activates a role on an account that already exists; a Panthera JIT account doesn't exist in a usable state until it's needed.
• Endpoints: removes standing local admin rights; requests to elevate a specific application go to a technician or are approved by rules you create, on Windows.
• Across clients: each client's tenant is connected separately, so one compromised connection doesn't expose every other client, and rules can apply to as many clients as you choose.
• Audit: logs privileged identity use and access events.

Frequently asked questions

Is Microsoft PIM a PAM?

Partly. Entra PIM handles just-in-time access, approvals, MFA on activation and audit history for roles in Entra ID, Azure and other Microsoft Online Services. It doesn't vault or rotate credentials, and it doesn't cover local Windows accounts, on-premises Active Directory or non-Microsoft systems, which a PAM platform does.

Do I need Entra ID P2 for PIM?

Yes, or Entra ID Governance. Microsoft says you need either license "to use PIM and all of its settings".

Does PIM manage local admin accounts?

No. PIM manages Microsoft cloud roles and Entra groups, and Microsoft excludes groups synchronized from on-premises. Local administrator accounts need Windows LAPS, Intune Endpoint Privilege Management or a PAM platform.

Does PIM work with GDAP?

Yes, through PIM for Groups: technician groups in the partner tenant are made eligible and assigned to each client's GDAP relationship, then activated when needed. It covers Microsoft roles only.

Is PAM part of IAM?

Yes. IAM covers every identity; PAM is the part of it that controls privileged accounts and their credentials, and PIM is one control within PAM.

Sources (checked 21 October 2026): Microsoft Learn, What is Microsoft Entra Privileged Identity Management? (updated 23 April 2026); Microsoft Learn, Privileged Identity Management for Groups (updated 23 April 2026); Microsoft Learn, Microsoft Entra ID Governance licensing fundamentals (updated 16 October 2026); Microsoft Partner Center, Introduction to granular delegated admin privileges (updated 28 April 2026); NIST CSRC glossary, privileged user (SP 800-53 Rev. 5); Microsoft Learn, Endpoint Privilege Management; T-Minus365, Secure your GDAP access with just-in-time permissions (11 December 2025).

Related: zero standing privilege for MSPs, just-in-time admin access for MSP technicians, how to remove local admin rights, Windows LAPS vs a PAM platform, Panthera free trial, book a demo.