The warden
PIM Manager
The warden: it controls who gets privileged access, and for how long.
A declarative, code-based Privileged Identity Management platform for Microsoft Entra ID. It replaces click-driven PIM with a database-driven desired-state model.
What it does
- PIM Manager web portal: model editing, dashboards and governance on Azure Container Apps, scaling to zero
- The Engine syncs your tenant to the desired model every 5 minutes
- Azure SQL as the single source of truth
- PIM Activator browser extension for one-click bulk activation
- Access model: Admins -> Role Groups -> Permission Groups -> Targets; no direct admin-to-role assignments
- Workloads: Entra ID roles, Azure RBAC, Power BI, Defender XDR, Intune, Exchange Online, enterprise applications, Dataverse and Azure DevOps
- Installs into your own Azure subscription; no stored credentials (certificates and managed identities)
How it deploys
Installs into your own Azure subscription. It authenticates with certificates and managed identities, so no credentials are stored.
PIM Manager is built on the PIM4EntraPS platform.
Compare editions
Community
Free and open source on GitHub.
Free
- Single tenant
- Delegation mapping
- Time-boxed access
- Audit trails and reports
Pro Single Tenant
Pro features for one Microsoft tenant.
Contact us
- Advanced connectors
- Access reviews
- Revocation
- Delegated administration
Pro MSP
Pro features across many customer tenants.
Contact us
- Multi-tenant capability
- MSP features
- Advanced connectors
- Access reviews
- Revocation
- Delegated administration
Always invoiced yearly in advance. B2B only: a Danish CVR or EU VAT number is required.