Why MIM PAM is the forgotten part of a MIM exit
Most Microsoft Identity Manager (MIM) retirement plans start with the Synchronization Service, the management agents, and the portal. Privileged Access Management (PAM) rarely gets its own line, because it often lives on separate servers in a separate forest, built by a project team that has since moved on. Yet MIM PAM controls something more sensitive than any user provisioning flow: who can become an administrator, and for how long. Azure IAM, LLC, an independent identity consulting firm that moves MIM estates to SailPoint IdentityIQ and Microsoft Entra ID, treats PAM as its own workstream. The firm’s MIM exit method is documented at https://azureiam.com/mim-to-sailpoint.
How MIM PAM works today
MIM PAM relies on two forests. CORP is the existing production forest, where users, computers, and applications stay. PRIV is a dedicated bastion forest built for PAM, holding shadow principals for the privileged groups and accounts in CORP.
The moving parts on the PRIV side are the MIM Service, its SQL Server database, an optional SharePoint based MIM Portal, the PAM Monitoring Service and, where needed, the PAM Component Service, plus PowerShell cmdlets for setting up PAM roles and requesting elevation.
When an administrator requests a role, the request runs through MIM workflows and policy. Once approved, the bastion forest grants a time-limited group membership. That membership produces a time-limited Kerberos ticket, and applications in forests that trust PRIV honor it. When the window closes, the right is gone without anyone removing it.
The date that matters
Microsoft’s lifecycle page lists Microsoft Identity Manager 2016 extended support ending on January 10, 2029. Service Pack 2 shows the same end date. MIM PAM is a feature of MIM 2016, not a separately licensed product, so it ends with MIM.
Service Pack 3, released in April 2026, added support for SQL Server 2022, SharePoint Subscription Edition, and other current platforms. Under Microsoft’s fixed lifecycle policy a service pack does not extend the product’s end date, so SP3 does not buy time past January 10, 2029. After that date there are no security updates, no non-security updates, and no assisted support for any MIM component.
Microsoft already narrowed where MIM PAM belongs
Well before the end date, Microsoft’s PAM documentation began stating that the MIM PAM approach is not recommended for new deployments in Internet-connected environments. The documentation now positions MIM PAM for a narrow set of cases:
- Isolated Active Directory environments with no Internet access
- Configurations required by regulation
- High impact isolated environments such as offline research laboratories and disconnected operational technology or SCADA networks
For connected and hybrid estates, Microsoft points to its securing privileged access guidance and to Microsoft Entra Privileged Identity Management (PIM). That guidance shapes the replacement plan more than the 2029 date does.
Three issues that break MIM PAM before 2029
Azure IAM checks three items at the start of every PAM assessment, because each one can take a deployment out of a supportable state years early.
Approval MFA. Microsoft Entra Multifactor Authentication Server stopped servicing MFA requests on September 30, 2024. Any MIM PAM approval that depended on it has to move to a custom MFA provider, Windows Hello, or smartcard based authentication in Active Directory. An estate that never made that change is approving elevation without the second factor it was designed around.
PRIV forest functional level. Deploying MIM PAM with a Windows Server 2012 R2 domain controller in the PRIV forest is deprecated. Microsoft calls for Windows Server 2016 or later at the Windows Server 2016 functional level for the PRIV domain. CORP may still run at the 2012 R2 level.
The portal platform. The optional MIM Portal is hosted on SharePoint. SharePoint Server 2019 reached end of support on July 14, 2026. SharePoint Subscription Edition support arrived only with SP3, so a PAM portal still on SharePoint 2019 is already running on an unsupported platform.
Connected forests: Entra PIM for Groups
For forests that can reach Microsoft Entra ID, the natural replacement is Entra PIM. PIM for Groups grants just-in-time membership or ownership of a security group, with the same policy controls PIM applies to Entra roles: approval, MFA at activation, justification, and a maximum activation time.
To reach applications that check Active Directory group membership through Kerberos or LDAP, Microsoft Entra Cloud Sync can provision cloud security groups and their membership to Active Directory Domain Services. A few documented constraints shape the design:
- Groups are written to Active Directory with Universal scope, so the forest must support Universal groups.
- Each provisioned group is limited to 50,000 members.
- Only members with an Active Directory account are written, and synchronized users need onPremisesObjectIdentifier matched to their objectGUID.
- The group provisioning job is scheduled every 20 minutes.
The last point is the one to test. MIM PAM produces Kerberos tickets that expire on their own at the end of the window. A PIM for Groups activation reaches Active Directory on the Cloud Sync provisioning cycle, and so does the removal. For ordinary application administrators that is usually acceptable. For tier zero rights, Azure IAM recommends measuring the actual activation and removal timing in a test forest before the bastion forest is retired.
Isolated forests: a decision, not a default
No Entra service reaches a forest with no Internet path. For the regulated, air-gapped, and operational technology environments Microsoft names, the options are:
- Keep MIM PAM past January 10, 2029 without vendor support, with documented compensating controls, a risk acceptance signed by the system owner, and a hard review date.
- Replace it with an on-premises privileged access product built for disconnected operation.
Either path is defensible. Drifting into the first one by default is not. Azure IAM asks for a named owner and a decision date for every isolated forest during scoping.
For an estate like Contoso’s, with one connected corporate forest and one isolated plant network, the result is usually two answers: Entra PIM for the corporate forest and a separate, documented decision for the plant.
Eligibility belongs in governance
Elevation tooling answers how an administrator gets rights for an hour. It does not answer who should be eligible in the first place. In a MIM to SailPoint IdentityIQ migration, Azure IAM moves that question into IdentityIQ. Privileged groups and the accounts eligible for them become entitlements, so they appear in access certifications and fall under separation of duties policy alongside the rest of the estate. IdentityIQ governs eligibility; Entra PIM or the chosen privileged access tool performs the elevation.
Decommissioning the bastion forest
Retiring MIM PAM is a change with security impact, not a server shutdown. The sequence Azure IAM follows:
- Inventory PAM roles, PAM users, shadow principals, and every application that trusts the PRIV forest.
- Stand up the replacement and run both in parallel, moving roles one at a time.
- Confirm each moved role with a test administrator, including activation, expiry, and the audit trail.
- Remove the PAM roles and shadow principals, then remove the trust MIM PAM configured between PRIV and CORP.
- Retire the PRIV forest servers in a planned change window.
A bastion forest left running without updates after 2029 becomes the very kind of privileged attack surface it was built to remove.
Next step
Azure IAM scopes MIM exits on a fixed fee, Privileged Access Management included, covering connected and isolated forests in the same plan. A consultation is available at https://azureiam.com/contact.
Azure IAM, LLC
2521 North Main
Unit 1-276
Las Cruces
New Mexico
88001
United States
