What is privileged access management (PAM)?

Privileged access management (PAM) is the practice of controlling admin rights: who may use them, for how long, with whose approval, and what gets recorded when they do.

What does privileged access management look like?

Microsoft Purview Privileged Access Management, a Microsoft 365 feature, shows how this works. A user who needs to do a privileged admin task requests access just for that task. An approver grants or denies it, and the access is narrow in scope and limited in time. Microsoft says an organization that turns it on operates with “zero standing privileges”: nobody keeps ongoing access to the tasks a policy covers. Privileged accounts themselves are defined in What is a privileged account?.

What does a PAM tool do?

The work splits into three jobs. NIST SP 800-53 Rev. 5, NIST’s catalog of security controls, has a control for the last two. Microsoft’s tools show what each job looks like in practice.

1. Approval before use. Someone asks for admin rights for a task, and another person approves. Microsoft Entra Privileged Identity Management (PIM) can require approval before a role turns on, and asks the user for a reason.
2. Rights limited to the people, task and time. AC-6(5) restricts privileged accounts to people or roles you define. PIM can grant access with start and end dates, and can require multi-factor authentication (a second check beyond the password) to turn a role on.
3. A record of what was done. AC-6(9) asks you to log the execution of privileged functions. PIM sends notifications when someone turns on a privileged role and lets you download audit history. In Purview, the audit log records every activity for an approved task.

Some tools, PIM among them, add a fourth job: periodic review. AC-6(7) asks you to review assigned privileges at a frequency you set and remove the ones nobody needs. AC-2(7) asks you to watch privileged role assignments and revoke them when they’re no longer appropriate. PIM’s access reviews check that users still need their roles.

What about admin logins that can’t be split?

PIM and Purview grant rights to each person’s own account. That works only when the service lets you give each person admin rights. A service with a single admin login, such as the AWS root user, has no role to turn on person by person.

AWS’s advice for its root user shows the other approach: control access to the password itself. AWS asks you not to share the root password and MFA with anyone who lacks a strict business need. It suggests that reaching the stored password should take the approval of at least two people. AWS also wants every access to the password, or to the place it’s kept, logged and watched. That log is what ties each use of the shared login to a person.

How does PAM apply to SaaS admin consoles?

The requirement is the same: limit who holds admin rights and record their use. What differs is coverage. Microsoft’s tools are built around Microsoft roles. PIM handles roles in Entra ID, Azure and other Microsoft online services such as Microsoft 365. Purview’s privileged access management works at the task level in Microsoft 365, and its FAQ points to the Microsoft 365 roadmap for support beyond Exchange. For admin consoles from other companies that you open in a browser, check each PAM product’s documentation for whether it covers them, or only servers and cloud roles.