Your policies, enforced
Every activation runs through Microsoft Entra PIM, with the same maximum durations, approvers, MFA, ticketing and Conditional Access requirements.
Microsoft Entra PIM, inside Microsoft Teams
PIM without the portal
Request, approve and track just-in-time privileged access where your team already works. No more portal hopping or buried approval emails.
Privileged access shouldn't need a detour
Microsoft Entra PIM keeps standing admin access out of your tenant. But activating a role means a trip to the Azure portal, and approving one starts with an email. TeamsPIM moves both into Teams.
Security stays where it is. Only the detour goes.
TeamsPIM doesn't replace PIM or copy your role data. It works through Microsoft Graph and Azure Resource Manager, so your existing PIM settings stay in charge.
Real identities, full audit
People request and approve with their own Microsoft account, so PIM records exactly who asked, who decided and why.
Just-in-time, just enough
Roles stay active only for the hours requested, with a countdown and a reminder five minutes before access ends.
From request to active role, without leaving Teams
Request
Pick an eligible role in the Dashboard tab, set the duration, add your reason and select Activate.
Decision
Approvers named in the role’s PIM settings get a card in their TeamsPIM chat and select Approve or Deny.
Active
The role is active and the time left is in view on the dashboard, with a reminder five minutes before it ends.
On record
The reason and each step show in your request history.
Everything PIM users do every day
Built for the people who request and approve privileged access, not just the people who configure it.
Roles, groups and Azure
Activate Microsoft Entra directory roles, PIM for Groups membership or ownership, and Azure roles on subscriptions and resource groups.
One-click repeat requests
Most Frequent PIM Requests lists the roles you activate most, each with its own Activate button.
Approvals in chat
Approvers review the role, requestor, reason and duration on an adaptive card, and every approver’s card shows who decided.
Activity-feed notifications
Approvals, denials and expiry warnings arrive in the Teams activity feed, so nobody has to watch their inbox.
History and reports
My Requests keeps a month of history, and admins with a reporting role get PIM reports on assignments and activations.
Wherever Teams runs
Works in Teams on desktop, web and mobile, and follows your light, dark or high-contrast theme.
A request, start to finish
Ask with a reason
Your eligible roles, groups and Azure resources are listed under My Roles. TeamsPIM reads each role’s PIM settings, so you see up front whether it needs approval, MFA or a ticket number, and how long you can ask for.
Approve where you already are
Approvers get a card with everything they need to decide: the role, who asked, their reason and how long for. A justification is required, and the decision is made with the approver’s own identity.
What you need
- Microsoft Entra ID P2 or Microsoft Entra ID Governance for the roles you manage
- Privileged Identity Management in use, with eligible assignments for your users
- Admin consent for TeamsPIM from a Global Administrator
- A TeamsPIM subscription from Microsoft AppSource, and a licence for each user
- Work or school accounts. Personal Microsoft accounts aren’t supported.
Bring PIM into Teams
Set up TeamsPIM for your organisation in a few steps, then let people request and approve access where they already work.