Set Up Azure DevOps PIM Access with Just-In-Time Role Activation

Admin roles in Azure DevOps hold powerful permissions, from editing pipelines to managing repositories and service connections. Leaving these roles permanently assigned increases the risk of accidental changes or unauthorized access.

To reduce this risk, Microsoft recommends using just-in-time (JIT) access through Azure AD Privileged Identity Management (PIM). This ensures that users only elevate to roles like Project Collection Administrator (PCA) when needed, and for a limited time. 

In this guide, you’ll learn how to configure PIM access for Azure DevOps based on Microsoft’s official setup, using security groups and conditional role activation.

1. Pre-Requirements

Before you start, make sure:

• Your Azure DevOps organization is connected to Azure AD
  
• You have an Azure AD Premium P2 license
  
• You have admin rights to create groups, assign permissions, and enable PIM
  
• The users involved are internal Azure AD members (not guest accounts)
  

2. Create a Security Group in Azure AD

This group will be used to manage PIM-based access to Azure DevOps.

Steps:

1. Go to the Azure Portal and open Azure Active Directory
   
2. Navigate to Groups < + New Group

3. Select Security as the group type
   
4. Set a name like AzureTalks
5. Keep Membership type as Assigned
   
6. Click Create
   

3. Enable PIM on the Group

To manage the group with PIM, you must enable privileged access.

Steps:

1. In Azure AD, go to Azure AD Privileged Identity Management
2. Select Enable Azure AD PIM for this group to start.

3. Click Azure AD roles < Groups
   
4. Locate your new group and click it
5. If not already enabled, click Enable PIM and wait for confirmation

4. Assign Users as Eligible Members

Now assign users as eligible (not active) members of the group.

Steps:

1. In the group’s PIM page, click Eligible Assignments

2. Choose Add assignments
3. Select users to add
   
4. Set the assignment type to Eligible

5. Click Assign
   

These users will be able to request access only when needed.

5. Configure PIM Activation Settings 

You can set additional rules for role activation.

Settings Options:

• Require approval: Choose a user (e.g., team lead) to approve requests
  
• Require justification: Ask users to provide a reason
  
• Enforce MFA: Require MFA at activation time
  
• Activation duration: Set the access time window (e.g., 1 hour)
  

Configure these settings by clicking the group in PIM < Settings < Member

6. Add the Group to Azure DevOps Admin Role

Now link the group to the Project Collection Administrators role in Azure DevOps.

Steps:

1. Go to https://dev.azure.com
   
2. Click Organization Settings < Permissions

3. Select Project Collection Administrators
   
4. Click + Add
   
5. Search for and select the Azure AD group you created (PIM-AzDO-Admins)
   
6. Save your changes
   

Now, only users who activate access through PIM will have PCA permissions.

7. Test Activation Flow (User + Approver)

User Activation:

1. User signs into Azure Portal
   
2. Goes to Azure AD < PIM < My Roles
   
3. Under Groups, clicks Activate
   
4. Provides justification (if required) and clicks Activate
   

Approver Flow (if configured):

1. Approver opens Azure AD < PIM < Approve Requests
   
2. Reviews request and clicks Approve or Deny
   

Once approved, the user appears in the PCA role in Azure DevOps for the set time.

8. Validate Access in Azure DevOps

To confirm access was granted:

1. Go to Organization Settings < Permissions
   
2. Open Project Collection Administrators
   
3. Ensure the user shows up only while the role is active
   

When the activation expires, the user is removed automatically.

Conclusion 

I hope this guide helped you follow Microsoft’s exact setup for managing Azure DevOps admin access through PIM. This method gives your team flexibility to activate roles when needed, while keeping your environment secure and audit-ready.

Once set up, this approach also scales to other sensitive roles like Build or Release Admins. And the best part it’s built into Microsoft’s security framework, so you can rely on it with confidence.