Entra PIM vs. Delinea vs. CyberArk: Don’t Buy the Wrong PAM

Privileged Identity Management, in Microsoft’s vocabulary: a feature that hands you a directory role you already qualify for, for a few hours, after someone signs off. Privileged access management, in everyone else’s vocabulary: the product category that vaults, rotates, brokers, and records the credentials your infrastructure actually runs on. Same three letters, wildly different scope. Somebody in your next procurement cycle is going to conflate them.

You would reasonably read a title like this one and expect three products competing for the same purchase order. Two of them are. The third is a governance control that already ships inside a license you may hold, and scoring it feature-for-feature against a credential vault is how buyers end up with an audit finding and a signed contract for the wrong thing.

PIM and PAM Are Not the Same Control

Start with the boundary, because every ranking comparison on this topic skips it. Microsoft Entra Privileged Identity Management governs role activation for identities inside Microsoft’s cloud. Delinea Secret Server and CyberArk Privileged Access Manager govern credentials wherever they live. Here is the split that should shape your shortlist:

Control	Microsoft Entra PIM	Delinea	CyberArk
What it grants	Time-bound activation of a role the user is already eligible for	Checkout of a vaulted credential, plus endpoint elevation	Checkout or ephemeral injection of a vaulted credential, plus endpoint elevation
Credential vaulting	None	Secret Server	Digital Vault
Native session recording	None; Azure Bastion Premium covers Azure VMs only	Per-secret recording in Secret Server	Isolated and recorded by default through the Privileged Session Manager (PSM)
On-prem AD, Linux, network gear, databases	Out of scope	In scope	In scope
Deployment footprint	SaaS, nothing to install	SaaS or self-hosted, plus on-prem engines	Self-hosted or Privilege Cloud, plus on-prem connectors

Role Activation Versus Credential Custody

Read that first row twice. Entra PIM never holds a secret. It flips an identity between eligible and active states, which means the account, the password, and the token lifecycle all still belong to Entra ID. A vault does the opposite: it owns the credential and lends it out under supervision.

That distinction decides your evaluation. If your privileged accounts are Global Administrator, Intune Administrator, and a pile of Azure subscription Owners, you are shopping for role governance. If they are root on 400 RHEL boxes, the sa account on a SQL cluster nobody has patched since the merger, and a Cisco enable password taped inside a rack door, no amount of PIM configuration touches them.

Where Entra PIM Stops

Entra PIM is genuinely good at the job it has. It is also bounded in ways the product page does not advertise, and those bounds are exactly where your PAM program either succeeds or quietly develops a gap.

What Entra PIM Governs

The documented scope covers Microsoft Entra ID roles, Azure resource roles, and group membership or ownership through PIM for Groups. Within that boundary you get:

• Eligible assignments that require an explicit activation step instead of standing membership.

• Approval workflows with named approvers who receive email and can deny a request outright.

• Activation maximum duration configured per role, which the role settings documentation caps at one to 24 hours.

• Access reviews and downloadable audit history for the elevation events themselves.

That is a real reduction in standing privilege, and it costs you nothing to install. Configuration, not deployment, is the entire project.

What Entra PIM Cannot Reach

Now the part your auditor cares about. Entra PIM records that Dana activated Exchange Administrator at 14:12 and that Priya approved it. It records nothing about what Dana did next. It also has no visibility into on-premises Active Directory Domain Services, local administrator accounts, Linux sudo rules, database logins, application service accounts outside Entra ID, or anything running in AWS or GCP.

The usual answer is to bolt on Azure Bastion session recording, which captures graphical RDP and SSH sessions to Azure VMs. It works, with caveats worth knowing before you promise an auditor anything. Recording requires the Bastion Premium SKU, it covers only VMs in the bastion’s virtual network or a directly peered one, it is unavailable through the native client, and Entra ID authentication for portal RDP sessions cannot run concurrently with graphical session recording.

You should also weigh Microsoft’s track record on identity adjacencies. Entra Permissions Management, the cloud entitlements product that sat next to PIM, reached end of sale and retirement with customers auto-offboarded on the cutoff date. PIM itself is core to Entra ID Governance and is not going anywhere, but “Microsoft ships an adjacent module” is not the same guarantee as “Microsoft supports it for a decade.”

The boundary is easier to argue about once you can see it drawn, as the diagram below lays out.

---

Warning: If your Entra ID P2 or Entra ID Governance license lapses, eligible role assignments are removed and PIM configuration settings disappear. Permanent role assignments survive. A billing dispute can therefore convert your carefully designed just-in-time model back into standing privilege without anyone filing a change ticket.

---

What Rollout Effort Actually Costs on Each Platform

Effort estimate is the deciding factor for most teams, and the gap between a scripting job and a platform rollout is the sharpest contrast in this whole comparison.

The Entra PIM Conversion

No ranking post on this topic tells you what the three conversions actually involve. Converting standing admins to eligible admins in Entra PIM is a scripting job against the Microsoft Graph PowerShell SDK, not a deployment. Nothing gets built and nothing gets pushed to an endpoint. Sign in as a Privileged Role Administrator, consent to the RoleEligibilitySchedule.ReadWrite.Directory scope from the Graph permissions reference, and issue one request per assignment you are converting:

$params = @{
    Action           = "AdminAssign"
    PrincipalId      = (Get-MgUser -UserId "[email protected]").Id
    RoleDefinitionId = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Exchange Administrator'").Id
    DirectoryScopeId = "/"
    Justification    = "Tier 1 messaging support, eligible only"
    ScheduleInfo     = @{
        StartDateTime = Get-Date
        Expiration    = @{ Type = "AfterDuration"; Duration = "P180D" }
    }
}

New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params

Four of those values decide whether the conversion holds up under review. Action takes AdminAssign to create an eligibility and AdminRemove to revoke one, so a single script shape handles both halves of a migration. DirectoryScopeId set to / means tenant-wide; point it at an administrative unit when the role only needs to cover one region or business unit. Expiration.Type accepts AfterDuration, AfterDateTime, or NoExpiration, and NoExpiration is the setting that quietly recreates the problem you are solving. Duration uses ISO 8601, so P180D expires the eligibility itself in 180 days and forces a renewal conversation. Ask for the broader RoleManagement.ReadWrite.Directory scope only when the same script also manipulates active assignments, because consenting to it hands the app the ability to grant any directory role.

Budget two more passes beyond that one call, and they are where the real hours go. Activation policy lives in a separate object entirely, so maximum duration, multifactor enforcement, approvers, and justification text are a second scripting job that the rules mapping guide maps setting by setting onto its Graph rule. Verification is the third pass: check the status the request returned before you read anything back, because a request that went through comes back 201 Created carrying a status of Provisioned. Then read the schedule back with Get-MgRoleManagementDirectoryRoleEligibilitySchedule filtered on the principal before you remove anyone’s permanent assignment, and chase an empty result there to licensing on the target user. Sequence matters. The license has to land before the eligibility, and the permanent assignment comes out last. Reverse that order and you lock someone out of a role they still need. Call the whole thing a few days of scripting and a change window.

Pricing the Vault Rollout

Now price the same work on the other two, because this is where the comparison stops being close. Delinea and CyberArk both start with infrastructure you stand up before the first credential is ever vaulted. Delinea begins with distributed engines near each site and a message queue behind them, and only then does discovery run to find the accounts you are about to take custody of. CyberArk begins with a hardened Vault and a connector fleet sized to your concurrent session count, and Safe and platform design has to be settled before onboarding starts, which is why certified engineers appear in the statement of work. Days against quarters is the honest shape of it. That gap is the strongest argument for keeping the governance layer you already own even after you sign for a vault, and it sets up the question the next two sections answer: what does the vault buy you that PIM cannot reach?

Delinea: Secret Server, Server Suite, and the Centrify Inheritance

Delinea came out of the Thycotic and Centrify merger, which is why it ships a credential vault and an Active Directory bridge that were engineered by different teams for different customers. That lineage explains both the strengths and the seams you will find during a rollout.

Where Delinea Wins

Secret Server is the vault, and its session recording model is refreshingly literal. Recording is a two-level switch: on globally for the instance, then on again per secret, as the session recording configuration guide describes. Both levels are reachable through the Secret Server REST API, so you can turn recording on across an entire secret template without touching the console. Recording follows the launcher, so RDP, PuTTY, SSH, and SQL Management Studio sessions all start the same way, but what each one yields depends on the component behind it. The protocol handler and the Web Password Filler produce video, while the RDP and SSH proxies and the ASRA produce keystroke data. Process metadata comes from the ASRA alone, and the Secret Server Session Connector records nothing at all.

Server Suite is the other half, and it is the reason Delinea shows up on Linux-heavy shortlists. Its zone model joins Unix and Linux hosts to Active Directory and stores Unix attributes in AD, so a root login becomes an AD identity with an AD group policy and an AD audit trail. Hierarchical zones are the ones worth designing around, because they carry inheritance and per-host overrides down a tree you control. Classic zones are a backward-compatibility artifact from the Centrify era, and you inherit them rather than choose them. Skip zone design altogether with adjoin --workstation when per-host role control is not worth the effort. That architecture collapses identity silos faster than any greenfield vault rollout will.

Where Delinea Frays

Modularity is the recurring complaint, and it is fair. Vaulting, endpoint elevation, Unix identity consolidation, and DevOps secrets ship as four products, each licensed on its own line item and administered from its own console. At two dozen privileged systems that is invisible. At two thousand, integration between the modules becomes somebody’s full-time job.

The recording pipeline has real operational requirements too, and Delinea documents them plainly:

• Delinea’s session recording architecture reference strongly recommends RabbitMQ as the message bus rather than the built-in MemoryMQ.

• Keystroke search on RDP needs the Advanced Session-Recording Agent (ASRA) installed on the target, not just on the vault.

• Delinea’s own caveats page tells you not to record more sessions than you can encode, and recommends a retention policy built on the automatic deletion feature.

Unlimited session recording runs into an encoding limit long before it runs into a policy debate. Sessions recorded past what your web nodes can process sit in a queue waiting on server resources, which Delinea warns could be a very long time, or never once storage is overwhelmed. Storage fills at roughly 15 hours of recording per GB, so sixty people recording eight-hour days for a year lands near 11 TB, and the 1 TB Delinea suggests for active users covers about a month of that. Test what encoding rate your configuration actually sustains before you turn recording on broadly, and set the automatic deletion policy at the same time so old video ages out on a schedule instead of piling up behind a stalled encoder.

CyberArk: Vault Depth, Session Isolation, and the Palo Alto Question

CyberArk is the platform the other two get compared against, and the reason is architectural rather than promotional. Its Privileged Session Manager proxies the connection so the target credential never reaches the administrator’s workstation at all.

How Session Isolation Actually Works

The isolation mechanism is worth understanding because it is the part competitors approximate. When a user starts a session, PSM creates a shadow user on the proxy machine and logs into the target as that shadow user, which is what keeps two concurrent sessions from the same PSM server from leaking into each other. The PSM configuration reference also defines what happens when the Vault is unreachable and a recording cannot upload, and you want to read that section before you assume recordings are guaranteed.

On the audit side, the Password Vault Web Access console (PVWA) gives auditors one place to search recordings by SQL command, SSH or SCP command, blocked command, keystroke, or Windows event, per the session monitoring documentation. Access is gated on the View Audit authorization in the relevant Safe or membership in the Auditors group, which is exactly the separation-of-duties control an auditor will test. PSM for SSH extends the same isolation to Unix targets without forcing administrators out of their native workflow.

The Palo Alto Networks Variable

Your risk register needs one more line before you sign. CyberArk is a wholly owned subsidiary of Palo Alto Networks after a roughly $25 billion acquisition, which means the Identity Security Platform’s roadmap is set inside a much larger portfolio strategy and can be bundled at renewal. Nothing about that is inherently bad. It does mean the renewal conversation on a multi-year commitment may arrive attached to products you never evaluated, priced as a package you cannot decompose. Ask for standalone pricing in writing and get the renewal mechanism named in the contract rather than in a slide.

Session Recording Decides Your Audit Evidence

Every PAM evaluation eventually collapses into one question from your auditor: show me what the administrator did. PCI DSS Requirement 10.2.1.2 wants audit logs capturing all actions taken by any individual with administrative access, and “we logged the elevation request” is a different artifact from “we have the session.”

Audit question	Entra PIM	Delinea Secret Server	CyberArk PSM
Who elevated, when, and who approved	Native, with downloadable history	Vault audit log per secret	Vault audit log per account
What the administrator typed	Not captured	Keystroke data with the ASRA agent installed	Searchable keystroke and command logs
Video playback of the session	Azure VMs only, via Bastion Premium	Per-secret recording through the launcher	Recorded by default on brokered sessions
Credential never exposed to the endpoint	Not applicable; no credential involved	Depends on launcher and proxy configuration	Shadow-user isolation on the PSM proxy
Auditor self-service search	Entra audit logs	Session monitoring console	PVWA recording search, gated by View Audit

What Your Auditor Actually Asks For

Row two decides whether your PAM program produces evidence or produces paperwork about evidence. Entra PIM tells you a privilege was granted; Delinea and CyberArk tell you what was done with it, and only after you have installed the right agent or connector on the right targets. Assume every auditor eventually asks for the second thing.

Trace one privileged action through all three platforms and the evidence gap becomes obvious, as you can see below.

---

Pro Tip: Ask your auditor which row of that table they will actually request before you scope the deployment. Teams routinely buy isolation and searchable keystroke logs to satisfy an auditor who only ever asks who elevated and who approved.

---

What Each Platform Costs to Own

Three-year total cost of ownership is where these products separate most sharply, and almost none of the difference is the license line.

The following breakdown is illustrative and reflects cost structure, not quoted pricing. Delinea and CyberArk both sell through quotes, so treat the shape as guidance and your reseller’s spreadsheet as truth.

Cost line	Microsoft Entra PIM	Delinea	CyberArk
Software licensing	Included with Entra ID P2 or Entra ID Governance	Net-new subscription, per module	Net-new subscription, per module
Incremental cost if you already hold Entra ID P2	Zero	Full price, no overlap credit	Full price, no overlap credit
Infrastructure	None	On-prem distributed engines and RabbitMQ	Vault or Privilege Cloud tenant, plus PSM and Central Policy Manager (CPM) connectors
Professional services	Usually in-house	Moderate, mid-market scoped	Substantial, certified engineers expected
Ongoing operations	Part of an existing identity role	One security engineer, part time to full time	Dedicated PAM engineering capacity

The Licensing Overlap Question

Your CFO will ask this one first, so answer it directly. If you already pay for Entra ID P2 or Entra ID Governance, Entra PIM’s incremental software cost is zero. Buying Delinea or CyberArk does not refund any part of that license, and neither vendor discounts because you own P2. You are not choosing between them financially. You are deciding whether to add a vault on top of governance you already paid for.

---

Reality Check: The line item that wrecks PAM budgets is not the vault. It is the human who owns password rotation policies against legacy applications that break when the password changes. Budget that person before you sign, or the vault becomes a very expensive read-only credential list.

---

The Coexistence Pattern Most Hybrid Estates Land On

Here is the architecture that most hybrid organizations arrive at after a year of arguing about it, usually by accident rather than design.

Entra PIM governs cloud role elevation and a vault governs credentials, but the dividing line is neither “Microsoft versus not Microsoft” nor “cloud versus on-prem.” What decides ownership is whether the protected thing is a role assignment or a secret.

Entra PIM keeps the role side of that line. Directory roles, Azure resource roles, and PIM-managed group membership stay with it, and the multifactor and justification requirements ride along at activation time rather than at sign-in.

Which Side Owns What

The vault takes whatever is a stored secret rather than an assignment. On-premises Active Directory Tier 0 accounts and Linux root are the obvious residents. Network device credentials and database logins are the ones nobody claims until an auditor asks who can read them, along with every application-to-application secret sitting in a config file somebody wrote in 2017.

What both sides share is the approval story. Route your ITSM ticket reference through both request paths so your reviewers work one queue rather than two unrelated ones, because the second queue is where approvals go to sit for four days. Draw the line explicitly and write it into your access policy, because the failure mode is a category nobody claimed rather than a category two teams both claimed. Service accounts are the usual orphan. Your identity team reads them as infrastructure and your infrastructure team reads them as an Entra problem, and they stay standing-privileged for as long as that argument runs.

The reference architecture below shows where that line usually falls and which approval path crosses it.

Score Your Estate with Ten Questions

Vendor verdicts age badly. Rubrics do not. Answer these ten about your own environment, count your points, and let the total pick for you.

How to Score

Every question below scores 0, 1, or 2. A 0 argues for Entra PIM, a 1 for Delinea, a 2 for CyberArk. Skip any question that does not apply to your estate and leave it out of the count entirely, because a question you skipped is not the same as a question you scored 0 and averaging the two together tilts the result toward Entra PIM by accident.

1. Do you hold privileged credentials outside Entra ID? Score 0 when everything privileged already lives in Entra ID and Azure. Score 1 once on-prem AD, Linux, network gear, or databases hold privileged accounts, because PIM’s documented scope does not reach them. Score 2 when all four of those categories are in play.

2. Does a regulator or customer contract require session video, not just elevation logs? Elevation records alone score 0. Per-asset recording scores 1. Score 2 when the contract language demands isolation and tamper-resistant search rather than a video file an administrator could overwrite.

3. How many Linux or Unix hosts carry local privileged accounts? Score 0 under roughly 100. Score 1 above roughly 100, where AD bridging with zones starts paying for itself, and 2 above roughly 500, where per-host role control stops being optional.

4. Do you have third-party vendors or contractors needing privileged access? Score 0 when nobody outside your payroll ever gets a privileged session. A handful of named contractors on known systems scores 1. Score 2 once external access brokering has to be a standing capability with its own approval path.

5. Do you have dedicated PAM engineering capacity, or would this be someone’s fourth priority? Score 0 when PAM is nobody’s job today. Score 1 when one security engineer can carry it part time, and 2 when you can fund a named PAM engineer for the duration of the rollout.

6. Are your privileged accounts under 500, or in the thousands? Score 0 under 500. Score 1 between 500 and a few thousand. Above that, score 2, because module fragmentation turns into somebody’s full-time integration job at exactly that scale.

7. Do legacy applications hold embedded credentials that break on rotation? Score 0 when rotation is already safe everywhere. A short list of known offenders scores 1. Score 2 once you cannot name them all, because every unknown adds weeks to a vault rollout and raises the bar on rotation policy tooling.

8. Are you already paying for Entra ID P2 or Entra ID Governance? Score 0 when you hold either one, because the zero-cost governance layer belongs in your design regardless of what vault you buy. Score 1 when you hold neither and every control on the table is net-new spend.

9. Do machine identities, workload identities, or AI agents hold privilege in your estate? Score 0 when human accounts are the whole problem. Score 1 when service accounts are the extent of it, and 2 once non-human identities outnumber your people and nobody on your shortlist has a concrete answer for them.

10. Can you tolerate a 6-to-18-month rollout, or do you need control this quarter? Score 0 when you need control this quarter. Score 1 for a six-month window, and 2 when you can fund and staff the full eighteen.

Sum the points and divide by the number of questions you answered. Below 0.5 says the governance layer you already own covers your real risk. Between 0.5 and 1.4 points at Delinea. Above 1.4 says you have the complexity and, ideally, the staffing that CyberArk assumes.

The Two Limits That Overrule the Average

An average is a recommendation, not a plan, so run it against two hard limits before you take it to a vendor. Staffing is the first limit. If question 5 scored 0, your answer is Entra PIM plus whatever you can personally operate, no matter what the arithmetic said, because an unstaffed vault degrades into a read-only credential list inside a year and you will still be paying for it. Calendar is the second limit. If question 10 scored 0, a CyberArk-scale deployment is off the table for this fiscal year even at a 1.8 average, and the realistic move is converting standing admins to eligible admins now and reopening the vault decision at the next budget cycle.

An average that clears both limits is a decision you can defend in a procurement meeting. One that fails either is a wish list with a number attached, and your CFO will find that out faster than you will.

Which Platform Fits Your Environment

Nobody wins this comparison outright, because the three products do different jobs and only two of them overlap.

Choose Entra PIM alone when your privileged surface genuinely lives inside Entra ID and Azure, your compliance obligations are satisfied by elevation records plus Bastion recording on the VMs that matter, and you already hold P2 or Governance licensing. Start with the deployment plan, convert your standing Global Administrators to eligible assignments this month, and stop pretending you need a vault you cannot staff.

Choose Delinea when you have real infrastructure credentials, a Linux or Unix estate large enough to justify identity consolidation, and a security team measured in single digits. You get vaulting, per-secret recording, and AD bridging without a certified-engineer dependency. Accept that you will manage several modules, and pick your recording targets deliberately rather than enabling everything.

Choose CyberArk when the evidence requirement is absolute, the estate spans legacy and multi-cloud, and you can fund dedicated PAM engineering for the duration. Then negotiate standalone pricing and a roadmap commitment in the contract, because the Palo Alto Networks integration is a real variable and your renewal will happen inside it.

The Test to Run Before You Sign

Whatever you pick, run one exercise first: pull the last privileged action taken on your most sensitive system and try to produce the full evidence trail from what you have today. Most teams cannot, and the specific place that exercise breaks down tells you more about which platform you need than any feature matrix will.