Standing vs Just-in-time Admin Access

The question it answers: Who holds admin roles permanently that could be activated just in time through PIM instead?

Who holds admin rights all the time that could instead be activated on demand through Privileged Identity Management. Every permanent privileged assignment is an account that can do damage the moment its credentials are stolen.

Note

Break-glass accounts are expected to hold Global Administrator permanently - see the Break-glass Account Health report.

At a glance

Where in the app	Entra ID › Security › Standing vs JIT Admin Access
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P2 (or Entra ID Governance) for the PIM view. Without it the report falls back to plain role assignments, which are all standing access.
Report id (API and MCP)	entra.security.privileged-access

Columns

Column	Key	Type
Principal	PrincipalDisplayName	Link
UPN	PrincipalUserPrincipalName	Text
Principal type	PrincipalType	Text
Role	RoleName	Text
Privileged	RoleIsPrivileged	YesNo
Assignment	AssignmentKind	Status
Scope	ScopeDisplay	Text
Ends	EndDateTime	Date

Filters

Filter	Key (API)	On when the page opens
Privileged roles only	privileged	Yes
Standing access only (permanent or time-bound)	standing	No

What it needs

Licence: Microsoft Entra ID P2 (or Entra ID Governance) for the PIM view. Without it the report falls back to plain role assignments, which are all standing access.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings

Data sources it reads

• GET /v1.0/roleManagement/directory/roleAssignmentScheduleInstances
• GET /v1.0/roleManagement/directory/roleEligibilityScheduleInstances
• GET /v1.0/roleManagement/directory/roleAssignments
• GET /v1.0/roleManagement/directory/roleDefinitions

Through the API and MCP

GET /ir-api/v1/reports/entra.security.privileged-access?size=100
GET /ir-api/v1/reports/entra.security.privileged-access?filter=privileged

An AI assistant reads it with the MCP tool get_report and the id entra.security.privileged-access. The client needs the Read grant for Entra ID. See Using the API.