# What is privileged access management (PAM)?

Privileged access management (PAM) controls who may use admin rights, for how long and with whose approval, and records what they did.

Updated: October 16, 2026

Privileged access management (PAM) is the practice of controlling admin rights: who may use them, for how long, with whose approval, and what gets recorded when they do.

## What does privileged access management look like?

Microsoft Purview Privileged Access Management, a Microsoft 365 feature, shows how this works. A user who needs to do a privileged admin task requests access just for that task. An approver grants or denies it, and the access is narrow in scope and limited in time. Microsoft says an organization that turns it on operates with "zero standing privileges": nobody keeps ongoing access to the tasks a policy covers. Privileged accounts themselves are defined in [What is a privileged account?](/guides/privileged-access/what-is-a-privileged-account).

## What does a PAM tool do?

The work splits into three jobs. NIST SP 800-53 Rev. 5, NIST's catalog of security controls, has a control for the last two. Microsoft's tools show what each job looks like in practice.

1. Approval before use. Someone asks for admin rights for a task, and another person approves. Microsoft Entra Privileged Identity Management (PIM) can require approval before a role turns on, and asks the user for a reason.
2. Rights limited to the people, task and time. AC-6(5) restricts privileged accounts to people or roles you define. PIM can grant access with start and end dates, and can require multi-factor authentication (a second check beyond the password) to turn a role on.
3. A record of what was done. AC-6(9) asks you to log the execution of privileged functions. PIM sends notifications when someone turns on a privileged role and lets you download audit history. In Purview, the audit log records every activity for an approved task.

Some tools, PIM among them, add a fourth job: periodic review. AC-6(7) asks you to review assigned privileges at a frequency you set and remove the ones nobody needs. AC-2(7) asks you to watch privileged role assignments and revoke them when they're no longer appropriate. PIM's access reviews check that users still need their roles.

## What about admin logins that can't be split?

PIM and Purview grant rights to each person's own account. That works only when the service lets you give each person admin rights. A service with a single admin login, such as the AWS root user, has no role to turn on person by person.

AWS's advice for its root user shows the other approach: control access to the password itself. AWS asks you not to share the root password and MFA with anyone who lacks a strict business need. It suggests that reaching the stored password should take the approval of at least two people. AWS also wants every access to the password, or to the place it's kept, logged and watched. That log is what ties each use of the shared login to a person.

## How does PAM apply to SaaS admin consoles?

The requirement is the same: limit who holds admin rights and record their use. What differs is coverage. Microsoft's tools are built around Microsoft roles. PIM handles roles in Entra ID, Azure and other Microsoft online services such as Microsoft 365. Purview's privileged access management works at the task level in Microsoft 365, and its FAQ points to the Microsoft 365 roadmap for support beyond Exchange. For admin consoles from other companies that you open in a browser, check each PAM product's documentation for whether it covers them, or only servers and cloud roles.


## Frequently asked questions

**Is PAM a product name?**

No. It names a way of controlling admin rights. Some vendors use it in a product's name, such as Microsoft Purview Privileged Access Management.

**What should a record of privileged access show?**

NIST SP 800-53 AC-6(9) asks you to log the execution of privileged functions. For that log to help, it needs to show which person acted and when.

**Can PAM work for an admin login that several people share?**

Role-based tools such as Entra Privileged Identity Management need a personal account for each admin. For a single shared login, control and log access to where the password is kept, as AWS advises for its root user.

## Sources

- [Microsoft Learn: Learn about privileged access management (Microsoft Purview)](https://learn.microsoft.com/en-us/purview/privileged-access-management)
- [Microsoft Learn: What is Privileged Identity Management? - Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2, AC-6)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [AWS Identity and Access Management User Guide: Root user best practices for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html)

## How Junify handles this

**Doing this by hand** You decide who gets admin rights through requests and approvals, log every use of the admin logins that stay shared, and have someone other than the admins review that log on a schedule.

**With Junify** Junify enters the username and password into an admin console for the person, so the people who use it never know the password. They verify on their own phone first, so each sign-in to each console is recorded by person. Traffic runs between the person's browser and the console, not through Junify. Junify doesn't cover server or operating system admin accounts.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=privileged-access&from=guide&cluster=privileged-access&slug=what-is-pam)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Managing the AWS root user and admin access for a team](/guides/privileged-access/aws-root-and-admin-accounts): AWS says to keep the root user for the few tasks only it can do. Give admins personal sign-ins through IAM Identity Center, and protect and log the root user.
- [Ways to manage shared SaaS admin accounts, compared](/guides/privileged-access/comparison-of-privileged-account-methods): A sign-out log, your identity provider's fill-in, a privileged access management (PAM) product, and an access tool such as Junify, compared on seven points.
- [Managing top-level admin accounts in Google Workspace and Microsoft 365](/guides/privileged-access/google-workspace-microsoft-365-admins): Keep few top-level admins, give everyone else a narrower role, require two-step verification for admins, and keep emergency accounts apart from daily ones.