Configure Entra PIM for just-in-time role activation

TL;DR — To get just-in-time role activation working in Entra PIM, you need three things in place: a PIM-capable license on the target user, the role assigned as Eligible instead of Active, and role settings that allow activation with the controls you want (for example MFA, justification, approval, and a max duration). The most common failure is assigning the role directly in Entra ID or Azure instead of through PIM eligibility, which leaves the user permanently active and unable to use activation. Reading time: ~5 min

Goal

When you are done, a target user can sign in to Entra Privileged Identity Management, activate an eligible role only when needed, satisfy the configured checks such as MFA or justification, use the role for the allowed duration, and then automatically lose the role when the activation window expires.

Prerequisites

• An Entra tenant where Privileged Identity Management is available for the roles you need to manage
• A user account with permission to manage PIM role assignments and role settings; in practice this is typically a privileged identity admin or equivalent delegated admin in your tenant
• The target user account that will receive the just-in-time role assignment
• A supported browser with access to the Entra admin center
• Optional but useful: Azure CLI installed if you also want to verify Azure resource role state from a shell; check with:

az version

• The exact role name you want to assign, for example Global Reader, User Administrator, or an Azure resource role such as Contributor
• The activation policy values you want before you start: maximum activation duration, whether MFA is required, whether justification is required, whether ticket information is required, and whether approval is required

Steps

Step 1: Open PIM for the correct scope

Open the Entra admin center, then go to:

Microsoft Entra admin center → Identity Governance → Privileged Identity Management

If you are configuring directory roles, open:

Privileged Identity Management → Microsoft Entra roles

If you are configuring Azure resource roles, open:

Privileged Identity Management → Azure resources

What you should see when this succeeds: the PIM dashboard for the selected scope loads and shows role assignment and settings options.

Step 2: Assign the role as Eligible, not Active

For Entra directory roles, go to:

Privileged Identity Management → Microsoft Entra roles → Assignments → Add assignments

Then set these literal values:

Member type: User
Select a role: <your role, for example User Administrator>
Assignment type: Eligible
Select member(s): <target user>
Start time: Now
End time: Permanent eligible

Click:

Assign

For Azure resource roles, first select the subscription, management group, or resource under:

Privileged Identity Management → Azure resources → Select resource

Then go to:

Assignments → Add assignments

And set:

Role: <your role, for example Contributor>
Assignment type: Eligible
Select member(s): <target user>
Start time: Now
End time: Permanent eligible

What you should see when this succeeds: the assignment appears in the Eligible assignments list for that role and user.

Step 3: Set activation requirements on the role

For Entra directory roles, go to:

Privileged Identity Management → Microsoft Entra roles → Roles → <your role> → Settings → Edit

For Azure resource roles, go to:

Privileged Identity Management → Azure resources → <selected resource> → Roles → <your role> → Settings → Edit

Set the activation controls to the literal values you intend to enforce. A common baseline is:

Activation maximum duration: 4 hours
On activation, require multifactor authentication: Yes
On activation, require justification: Yes
On activation, require ticket information: No
Require approval to activate: No
Require Conditional Access authentication context: No
Permanent active assignment allowed: No
Permanent eligible assignment allowed: Yes

If you need approvers, set:

Require approval to activate: Yes
Selected approver(s): <one or more approver accounts or groups>

Then click:

Update

What you should see when this succeeds: the role settings page shows the saved activation requirements and the new values persist after refresh.

Step 4: Have the target user activate the role

Sign in as the target user and open:

Microsoft Entra admin center → Identity Governance → Privileged Identity Management → My roles

For directory roles, open:

My roles → Microsoft Entra roles → Eligible assignments

For Azure resource roles, open:

My roles → Azure resources → Eligible assignments

On the target role, click:

Activate

Then enter the exact fields prompted by your policy, for example:

Reason: Production incident triage for API auth failures
Duration: 2 hours
Ticket number: INC-10427   (only if ticket info is required)

Complete MFA if prompted, then submit. What you should see when this succeeds: the role moves from Eligible assignments to Active assignments with an expiration time.

Step 5: Verify the effective access from the workload side

If the role is an Azure resource role, verify from a shell after activation using the target user session:

az login
az account show --output table
az role assignment list --assignee <user-upn-or-object-id> --all --output table

A successful output shape looks like:

Name                CloudName    SubscriptionId                        State    IsDefault
------------------  -----------  ------------------------------------  -------  ---------
Contoso-Production  AzureCloud   11111111-2222-3333-4444-555555555555  Enabled  True

Principal                             Role          Scope
------------------------------------  ------------  ---------------------------------------------------------------
user@contoso.com                      Contributor   /subscriptions/11111111-2222-3333-4444-555555555555

If the role is a directory role, verify in the portal at:

Privileged Identity Management → My roles → Active assignments

What you should see when this succeeds: the role is active for the configured duration and disappears automatically after expiry.

Verify it works

Run the verification that matches your scope.

For Azure resource roles, before activation you should typically see no matching active assignment or receive authorization failures for privileged actions. After activation, the role assignment should appear:

az role assignment list --assignee <user-upn-or-object-id> --all --output table

Expected shape after activation:

Principal                             Role          Scope
------------------------------------  ------------  ---------------------------------------------------------------
user@contoso.com                      Contributor   /subscriptions/11111111-2222-3333-4444-555555555555

If you test a privileged operation before activation, a failure often looks like:

(AuthorizationFailed) The client 'user@contoso.com' with object id 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/write' over scope '/subscriptions/11111111-2222-3333-4444-555555555555/resourcegroups/rg-prod' or the scope is invalid.
Code: AuthorizationFailed

After activation, retrying the same operation should succeed.

For directory roles, verify in the portal:

Privileged Identity Management → My roles → Microsoft Entra roles → Active assignments

Expected result: the activated role is listed with a start time and an end time. After the end time passes, refresh the page and confirm the role is no longer active.

Common pitfalls

Assigned the role directly instead of through PIM eligibility

Mistake: you gave the user an Active assignment in Entra ID or Azure RBAC, or you selected Assignment type: Active in PIM.

Symptom: the user already has the permission all the time, there is no Activate action, or the role shows under Active assignments permanently.

Fix: remove the direct or active assignment and recreate it as Assignment type: Eligible in PIM.

The user has no eligible role visible in My roles

Mistake: you assigned the role at the wrong scope, selected the wrong resource, or assigned a group when you intended a user and the group path is not what you are checking.

Symptom: My roles is empty, or the expected role never appears for activation.

Fix: open the exact PIM scope where you assigned it and confirm the assignment exists under Eligible assignments for the target principal and target resource.

Activation fails because MFA is required but not completed

Mistake: role settings require MFA on activation, but the user has not completed the MFA challenge or their sign-in flow is blocked.

Symptom: the activation request fails or loops back to sign-in; users often report that clicking Activate does nothing useful.

Fix: have the user sign out, sign back in, complete the MFA prompt during activation, and then resubmit the request.

Approval is required but no valid approver is configured

Mistake: Require approval to activate is enabled, but no approver was added or the approver account cannot approve in practice.

Symptom: activation requests remain pending indefinitely or fail at submission time depending on tenant policy behavior.

Fix: edit the role settings and add a real approver account or group under the approver list, then resubmit the activation request.

You expected immediate CLI authorization but token claims are stale

Mistake: the user activated the role in the portal but kept using an old CLI or application token.

Symptom: portal shows the role as active, but az commands still return AuthorizationFailed for several minutes or until reauthentication.

Fix: refresh credentials with:

az logout
az login

and retry the command.

Activation duration exceeds the role policy

Mistake: the user requested a longer activation time than the role allows.

Symptom: the activation form rejects the request or silently limits the allowed duration options.

Fix: request a duration less than or equal to the configured Activation maximum duration, or increase that limit in the role settings and save it before retrying.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.