Azure AD Premium P2 Features: PIM, Identity Protection, and Access Reviews Nobody Turned On
Azure AD Premium P2 features — Privileged Identity Management (PIM), Identity Protection, and Access Reviews — are gated behind Microsoft's second-tier premium license, but a P2 license being assigned to a user doesn't mean any of the three is actually configured in the tenant. Microsoft Entra ID P2 (the current name for Azure AD Premium P2) sits above P1 and is included in Microsoft 365 E5, E7, and Enterprise Mobility + Security E5. Standalone, it lists at $10/user/month (Microsoft Entra pricing). On paper it's the tier every security-conscious tenant should have. In practice, a lot of tenants have it assigned to some or all users and are using almost none of what it actually does.
That gap matters because these three capabilities aren't visual add-ons. They're the specific things Microsoft gates behind the P2 SKU (Microsoft Entra ID Governance can substitute for some of them, but P2 is the common path). If you're paying for the license and none of the three is configured, you're paying for capacity you're not using while your actual privileged-access and risk posture looks identical to a P1 tenant — see how to audit Microsoft Entra ID security for the full baseline this article's checks fit into.
Per Microsoft's own licensing reference, three specific capabilities require P2 (or Entra ID Governance) and are simply unavailable — not degraded, unavailable — below it: risk-based Conditional Access policies (sign-in risk and user risk), Privileged Identity Management for both Entra roles and Azure resource roles, and the current generation of Access Reviews (Microsoft Entra licensing — Microsoft Learn). This article walks through what each one does, what "configured" looks like on paper versus in the tenant, and how to detect and close the gap.
ℹ️ Note: The CIS Microsoft 365 Foundations Benchmark v7.0.0 includes hardening recommendations for PIM just-in-time privileged access and periodic access reviews. See AD and Azure Compliance: NIS2, ISO 27001, CIS Controls for how these controls map to specific frameworks.
How Each P2 Feature Actually Works
Privileged Identity Management (PIM)
PIM's model is "eligible" versus "active" role assignment. A user made eligible for a role — Global Administrator, for example — holds no standing privilege. To use the role, they request activation, which can require MFA, justification, or approval from a designated approver, and the resulting active assignment is time-bound and expires automatically (Microsoft Entra ID Governance — What is PIM). This is the just-in-time model that removes standing admin access as an attack surface — see Azure Privileged Access: Too Many Global Admins for what standing access without PIM actually costs you.
PIM also covers Azure resource roles (Owner, Contributor, etc. at any scope) and PIM for Groups, where eligibility for group membership or ownership itself requires a P2 (or Entra ID Governance) license for every eligible member, owner, approver, and reviewer — not just the administrators. Microsoft's own example scenarios make the licensing math concrete: a tenant with 42 administrators managed through PIM, plus 5 approvers and 6 reviewers involved in monthly privilege reviews, needs 53 licenses, not 42 (Microsoft Entra licensing — PIM section). Teams that budget P2 only for the admin accounts routinely under-license this and find approvers or reviewers silently locked out.
Identity Protection
Identity Protection scores sign-ins and users for risk using both real-time and offline (post-authentication) detections — leaked credentials, anonymous IP addresses, impossible travel, unfamiliar sign-in properties, and threat-intelligence-confirmed compromise, among others (Risk detection types and levels — Microsoft Learn). Low-risk detections age out automatically after six months; medium and high risk persist until an admin remediates or dismisses them. The risk score only becomes actionable when it's wired into a Conditional Access sign-in risk policy or user risk policy — without that policy, Identity Protection generates a report nobody looks at instead of an automated control. See Azure Identity Protection: Blocking Leaked Credentials for how to build that policy.
Access Reviews
Access Reviews let designated reviewers (a manager, resource owner, or the users themselves) periodically recertify group membership, application access, PIM-eligible role assignments, and guest access, rather than relying on someone remembering to remove access when it's no longer needed. The capability tier "previously generally available in Microsoft Entra ID P2" is what most P2 tenants have available today (Microsoft Entra licensing — Access reviews). Licensing follows the reviewed population, not just the reviewer: a review of a 500-member group with three group owners as reviewers requires 503 licenses in Microsoft's own worked example — the members being reviewed need coverage too, not only the people doing the reviewing.
Detection: Are You Actually Using What You're Paying For
License assignment and feature configuration are two different questions, and the Entra admin center makes it easy to confirm the first without ever checking the second. Here's what to check for each.
| What to check | Where / how | Signal of a gap |
|---|---|---|
| P2 licenses assigned vs. active | Microsoft 365 admin center → Licenses | Licenses assigned to users who never touch PIM, risk reports, or reviews |
| Roles managed via PIM vs. permanent | Entra admin center → ID Governance → Privileged Identity Management → Microsoft Entra roles | Global Administrator / Privileged Role Administrator held as permanent, non-PIM assignments |
| PIM audit trail | Entra audit logs, activity Add member to role outside of PIM (permanent) | Any recent hit means a role was assigned as a standing permanent grant instead of eligible/JIT (Entra audit log activity reference) |
| Risk-based Conditional Access | Entra admin center → Protection → Conditional Access → policies targeting sign-in risk / user risk | Zero policies referencing risk levels — Identity Protection is scoring users but nothing acts on the score |
| Identity Protection policy changes | Audit logs, category IdentityProtection, activity Update IdentityProtectionPolicy | No recent entries in a tenant that's supposedly using risk-based policy |
| Access reviews in flight | Entra admin center → ID Governance → Access reviews | Zero active or scheduled reviews for privileged roles, guests, or high-membership groups |
| Access review lifecycle | Audit logs, category Policy, activities Create access review / Access review ended | No Create access review events in the last 90 days despite the license being active |
Get-MgRoleManagementDirectoryRoleEligibilitySchedule (Microsoft Graph PowerShell SDK) returns every PIM-eligible assignment in the tenant, separate from Get-MgRoleManagementDirectoryRoleAssignmentSchedule for active/permanent ones — comparing the two lists is the fastest way to see how many privileged roles are actually running through PIM versus sitting as standing grants (Microsoft Graph PowerShell reference).
⚠️ Warning: PIM's own audit history only retains 30 days of data by default. If you need a longer trail to prove PIM adoption over time (or to investigate an older incident), route Entra logs to a storage account or Log Analytics workspace via Azure Monitor — the 30-day window is not enough for most compliance retention requirements (View audit log report for Microsoft Entra roles — Microsoft Learn).
Remediation: Turning On What You Already Own
💡 Quick Win: Start with Global Administrator and any role that can reset passwords or manage Conditional Access. Convert those from permanent to PIM-eligible first — that's the highest-severity gap and the fastest to close.
- Migrate permanent privileged assignments to PIM-eligible. In ID Governance → Privileged Identity Management → Microsoft Entra roles, review every active assignment. For roles that don't need standing access, remove the permanent assignment and create an eligible one with an activation duration, MFA requirement, and (for Global Administrator and similarly sensitive roles) approval.
- Turn on risk-based Conditional Access. Create a sign-in risk policy (e.g., require MFA at medium risk) and a user risk policy (e.g., require secure password change at high risk) under Protection → Conditional Access. Without this step, Identity Protection is a dashboard, not a control.
- Enable notifications for risky users. Configure the weekly digest and at-risk-user alerts under Identity Protection settings so risk isn't something an admin has to remember to check.
- Stand up access reviews for the highest-value scopes first: PIM-eligible role assignments, groups nested into privileged roles, and guest access — see Azure Guest Accounts: The Forgotten Attack Surface for why stale guest accounts are usually the worst offender. Set a recurring cadence (quarterly is a reasonable default) and assign resource owners or managers as reviewers rather than a single central admin who won't have context on every group.
- Re-check licensing math before you scale. PIM for Groups and Access Reviews both require a P2 (or Governance) license for every eligible member, approver, and reviewer — not only the target administrators. Under-licensing here means the tooling silently stops covering people it should.
- Verify against a benchmark. The CIS Microsoft 365 Foundations Benchmark's recommendations for PIM and access reviews give a concrete, auditable bar — useful both to confirm you've closed the gap and to justify the P2 spend to whoever approved it.
🚨 Danger: If a P2 (or Governance) license lapses or is removed, PIM doesn't just stop enforcing — Microsoft explicitly documents that eligible Entra role assignments are removed, any in-progress access reviews of Entra roles end, and PIM configuration settings are deleted (Microsoft Entra licensing — PIM license expiration). Permanent role assignments are unaffected by this, which is exactly why relying on PIM without keeping license coverage current is a false sense of security.
How EtcSec Detects This
EtcSec's Azure audit checks for AZ_NO_P2_LICENSE (P2 present in the tenant but its signal features unused), AZ_P2_NOT_FULLY_UTILIZED, PA_PIM_NOT_ENABLED, and PA_PERMANENT_ADMIN_ASSIGNMENTS to flag privileged roles held outside PIM, RISK_NO_SIGNIN_RISK_POLICY to catch Identity Protection running without an enforcing Conditional Access policy, and AZ_ACCESS_REVIEWS_NOT_CONFIGURED to flag tenants with no recurring access review coverage on privileged roles or guest access.
ℹ️ Note: EtcSec automatically checks for this vulnerability during every AD/Azure audit. Run a free audit to verify your environment.
Explore the identity security pages that support this topic