PIM for Emergency Access Accounts

Posted by Fabulous_Cow_4714@reddit | sysadmin | View on Reddit | 4 comments

This is what Microsoft official documentation says:

In Microsoft Entra Privileged Identity Management, you should make the Global Administrator role assignment active permanent rather than eligible for your emergency access accounts.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access#configuration-requirements

Others say avoid using any kind of PIM for break glass accounts.

Is there some risk of using permanently active PIM that is greater than any auditing benefit of using It instead of directly assigning the accounts as global admins?