Question

A financial services company uses Microsoft Entra Privileged Identity Management (PIM) to secure privileged roles. Security requires that all Global Administrator activations need multi-stage approval and MFA. During a recent Entra ID authentication outage, administrators could not activate roles to respond to an unrelated production incident, delaying recovery. The security architect must redesign privileged access so that day-to-day admin activations remain fully governed while ensuring a reliable path exists when PIM or Entra authentication services are degraded. What should the architect recommend?

Accepted Answer

Configure two cloud-only break-glass emergency access accounts with permanently assigned Global Administrator roles, excluded from Conditional Access and PIM, protected by long complex passwords and monitored with dedicated sign-in alerts.

Answer

Lower the PIM approval requirement for Global Administrator to self-activation without approval so admins can always elevate quickly during incidents.

Answer

Assign standing Global Administrator to the incident response team members and rely on PIM only for auditing their sessions.

Answer

Extend the PIM activation maximum duration to 24 hours so administrators rarely need to re-activate during an outage.