Azure IAM, LLC explains what happens to Microsoft Identity Manager's Privileged Access Management feature when MIM 2016 support ends on January 10, 2029, which forests still need a bastion design, and where Entra PIM and SailPoint take over.
-- Privileged Access Management is the Microsoft Identity Manager (MIM) feature that many identity teams forget they deployed until an auditor asks about it. A bastion forest built years ago to shadow administrative groups and hand out time-limited memberships is still running in a number of estates, often kept alive by one engineer. The question that follows every MIM 2016 lifecycle review is what happens to MIM's Privileged Access Management feature after 2029. Azure IAM, LLC, an independent identity consulting firm, says the date is simple and the replacement is not. The firm documents its MIM exit method at https://azureiam.com/mim-to-sailpoint.
The date. Microsoft's lifecycle page lists Microsoft Identity Manager 2016 extended support ending on January 10, 2029, the same end date shown for Service Pack 2. MIM PAM is a feature of MIM 2016, not a separate product, so it has no lifecycle of its own. Service Pack 3, released in April 2026, adds platform support but does not extend the product end date. After January 10, 2029, the fixed lifecycle policy means no security updates, no non-security updates, and no assisted support for any MIM component, including the PAM Monitoring Service and the PAM Component Service.
The guidance already in place. Microsoft's PAM documentation states that the MIM PAM approach is not recommended for new deployments in Internet-connected environments. Microsoft positions it for isolated Active Directory environments without Internet access, for configurations required by regulation, and for high impact isolated environments such as offline research laboratories and disconnected operational technology or SCADA networks. For connected and hybrid estates, Microsoft points to its securing privileged access guidance and to Microsoft Entra Privileged Identity Management (PIM).
Three checks before 2029. Azure IAM looks at three things that can push a MIM PAM deployment out of a supportable state well before the end date.
Approval MFA. Microsoft Entra Multifactor Authentication Server stopped servicing MFA requests on September 30, 2024. MIM PAM approvals that depended on it have to move to a custom MFA provider, Windows Hello, or smartcard authentication in Active Directory.
PRIV forest level. Deploying MIM PAM with a Windows Server 2012 R2 domain controller in the PRIV forest is deprecated. Microsoft calls for Windows Server 2016 or later at the Windows Server 2016 functional level.
The portal. The optional MIM Portal runs on SharePoint. SharePoint Server 2019 reached end of support on July 14, 2026, and SharePoint Subscription Edition support arrived only with Service Pack 3.
Where the workload goes. Azure IAM sorts MIM PAM estates by connectivity, because the answer differs.
Connected forests. Entra PIM for Groups grants just-in-time membership of a security group with approval, MFA, justification, and a maximum activation time. Microsoft Entra Cloud Sync can provision cloud security groups to Active Directory Domain Services, so Kerberos and LDAP applications see the membership. Microsoft schedules that group provisioning job every 20 minutes, so elevation and removal land in Active Directory on the provisioning cycle. MIM PAM works differently: the bastion forest issues time-limited group memberships, which produce time-limited Kerberos tickets that expire on their own. Teams that rely on short-lived rights for tier zero groups should test that difference before retiring the bastion forest.
Isolated forests. No Entra service reaches a forest with no Internet path. For the regulated, air-gapped, and operational technology environments Microsoft describes, the realistic choices are running MIM PAM past January 10, 2029 without vendor support, under documented compensating controls, or replacing it with an on-premises privileged access product built for disconnected operation. That decision needs a named owner and a date.
For an estate like Contoso's, with one connected corporate forest and one isolated plant network, the result is usually two answers: Entra PIM for the corporate forest and a separate decision for the plant.
Eligibility still needs governance. Whichever tool performs the elevation, someone has to decide who is eligible to request it. In a MIM to SailPoint IdentityIQ migration, Azure IAM moves that decision into IdentityIQ. Privileged groups and the accounts eligible for them become entitlements subject to access certification and separation of duties policy, so the list of people allowed to elevate is reviewed with the rest of the estate. IdentityIQ governs eligibility; the elevation itself stays with Entra PIM or the chosen privileged access tool.
Decommission on purpose. Retiring MIM PAM means removing PAM roles, shadow principals, and the trust MIM PAM configured between the PRIV and CORP forests, in a planned change window. A bastion forest left running without updates is a privileged attack surface of its own.
Azure IAM scopes MIM exits, Privileged Access Management included, on a fixed fee and offers a consultation at https://azureiam.com/contact.
Contact Info:
Name: Robin Lilly
Email: Send Email
Organization: Azure IAM, LLC
Address: 2521 North Main Unit 1-276, Las Cruces, New Mexico 88001, United States
Website: https://azureiam.com
Source: NewsNetwork
Release ID: 89208757
Should any problems, inaccuracies, or doubts arise from the content contained within this press release, we kindly request that you inform us immediately by contacting [email protected] (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our dedicated team will promptly address your concerns within 8 hours, taking necessary steps to rectify identified issues or assist with the removal process. Providing accurate and dependable information is at the core of our commitment to our readers.
