Just-in-Time Access in Entra ID: Admin for 2 Hours (PIM Demo)

What if your IT helpdesk only had admin rights when they actually needed them? In this video, I show how Just-in-Time access works in Microsoft Entra ID using Privileged Identity Management (PIM). A standard user gets the Helpdesk Administrator role for 2 hours, uses it to reset another user's password, and loses the access automatically when the time is up. I also explain how roles like User Administrator, Billing Administrator and Security Administrator can be delegated temporarily, so nobody carries 24/7 admin rights that attackers can phish or compromise. ❓ Is PIM the same as RBAC? Not exactly. RBAC defines the roles and what each role can do. PIM sits on top of those roles and controls when someone can use them: eligible by default, active only when needed, and removed automatically. ⏱ Chapters 00:00 - Introduction to Privileged Identity Management (PIM) 00:17 - Real-World Breach Scenario: Holiday Ransomware Attack 01:57 - What is Just-in-Time (JIT) Access? (Car Key Analogy) 03:08 - Practical Use Cases for Temporary Admin Rights 08:11 - Network Architecture & Lateral Movement Risks 10:46 - Demo Lab Setup: Global Admin vs. Standard User 12:43 - Testing Password Reset Without Admin Privileges (Error) 14:03 - Configuring PIM: Assigning Eligible Roles in Entra ID 16:00 - Eligible vs. Active Role Assignments Explained 17:45 - Requesting & Activating the 2-Hour Admin Role 19:57 - Global Admin Approval Workflow & Justification 21:18 - Verifying Active Elevated Access 22:08 - Successfully Executing the Delegated Admin Task 23:32 - License Requirements (Entra ID P2 / M365 E5) 23:54 - Early Deactivation & Revoking Privileges 25:38 - Verifying Post-Task Security & Conclusion 🔹 What you'll learn Why standing (24/7) admin access is a security risk What just-in-time access and PIM mean in simple terms How PIM and RBAC are different How a standard user gets temporary admin power How access is revoked automatically and manually ⚠️ PIM requires Microsoft Entra ID P2 or Entra ID Governance (included in Microsoft 365 E5). This demo runs in a lab tenant. 📌 Previous videos: I Simulated a Risky Sign-in (Then Blocked It with Entra ID):    • I Simulated a Risky Sign-in (Then Blocked ...   Lock Microsoft 365 to Your Office IP:    • Lock Microsoft 365 to Your Office IP (Cond...   _______________________________________ Music track: Snap Crackle by Aetheric Source: https://freetouse.com/music _______________________________________ #MicrosoftEntraID #PIM #JustInTimeAccess #IAM #Cybersecurity