Every organization starts its PIM journey with good intentions, and then the challenges show up. Admins activate a job role and get a bundle of permissions for the whole day. Consultants end up with the same rights as employees. Answering "who can reach Global Admin, and through which path?" means digging through nested groups and eligible roles. And permanent assignments keep coming back, because PIM takes too many clicks.

This session shares real-life lessons from large enterprises and the common mistakes behind each challenge:
• Too much access: why job-role bundles and tenant-wide roles fail, and how PIM for Groups with nested delegation groups gives each admin just the permission the task needs.
• Hidden privilege: finding the nested groups, eligible roles and app permissions that quietly lead to Tier 0.
• Platform limits: role-assignable groups, nesting rules and the workloads where PIM doesn't work the way you expect.
• Lifecycle gaps: consultants who left months ago, access reviews nobody acts on, and offboarding that leaves eligible roles behind.
• Adoption: why admins fall back to permanent roles, and how one-click activation changes that.

The examples come from real delegations for Power BI, Azure Landing Zones, Intune and Defender XDR.
Still on legacy Active Directory? See PIM for AD working, based on PIM for Entra ID combined with AD TTL group membership.

You'll also see two free community tools developed by the speaker, which solve these challenges in practice. PIM Manager turns your design into a self-running engine, and the PIM Activator lets admins activate all the access they need in one click.

Why job-role bundles and tenant-wide roles fail, and how to design "Just Enough, Just In Time" access with PIM for Groups and nested delegation groups.

How to find hidden privilege (nested groups, eligible roles and app permissions that lead to Tier 0) and work within Entra's platform limits for role-assignable groups and nesting.

How to close the lifecycle gaps for admins and consultants, and bring PIM to legacy Active Directory with PIM for AD.