Azure Active Directory Privileged Identity Management, otherwise known as PIM, is an Azure offering that allows you to manage and control access to resources within Azure and Azure AD, as well as within other services, such as Intune and Office 365. A valid Azure AD Premium P2 license is required for all users that will interact with or benefit from Privileged Identity Management before enabling the service on a tenant. Alternatively, you can assign an Enterprise Mobility + Security E5 license for each user that interacts with Privileged Identity Management. Generally speaking, licensing is required for users that are assigned to the Privileged Identity Role Administrator role or who are assigned as eligible to other directory roles that are manageable through Privileged Identity Management. If a user can approve or reject requests in Privileged Identity Management, that user also requires a license. Users assigned to a role with time-based assignments, such as Just in time or Direct, or those assigned to an access review role, also require licensing. With Azure AD Privileged Identity Management, an organization can see which users are assigned privileged roles that are used to manage Azure resources. Organizations can also see which users are assigned administrative roles within Azure Active Directory. 

Privileged Identity Management also offers the ability to enable on-demand, or just in time, administrative access to services such as Office 365 and Intune, as well as to Azure subscriptions, resource groups, and even individual Azure resources, like virtual machines and such. Azure AD Privileged Identity Management offers the ability to view a history of administrator activation, along with a history of changes that administrators have made to Azure resources. Alerts can also be configured to notify you about changes in administrator assignments. Privileged Identity Management also allows you to require approval for activation of Azure AD privileged admin roles, to review membership of such administrative roles, and to force users to provide justification for ongoing membership in these roles. In Azure Active Directory, Privileged Identity Management can be used to manage users that are assigned to built-in Azure AD roles, such as Global Admin. In Azure itself, Privileged Identity Management can manage users and groups assigned via Azure RBAC roles, such as the Owner and Contributor roles.