Currently in all project were I’m involved I’m trying to used Best Practices of Security, including the use of PIM. Privileged Identity Management it is a service that is available in Azure AD and is part of Azure AD Plan 2, it is used for all admin related tasks, where no employee has standing access within the company, reducing the surface of an attack.
PIM makes it possible to give a user the privilege to elevate his or her access rights for a preset amount of time to a higher role such as User Administrator or SharePoint Administrator.
PIM gives access to huge quantity of roles in Office 365 and Azure resources where the user is by default a reader and can elevate it to be an owner of a resource (group) for a specific amount of time (which is great!)
Enabling a PIM role is done by going to the Azure Portal and select the role you want to elevate. You need to do this for every role separately.
For example, imagine that you have members that need to elevate their account daily to be a SharePoint and User administrator, so they need to do this daily. After enabling they need to sign out and sign in again to make sure the roles are activated.
No more to give the role to a user and forget which role we give to them…
Albandrod's Memory 