How to Assign Microsoft Entra Roles in Privileged Identity Management

Standing admin access is a gift to attackers. Microsoft Entra Privileged Identity Management (PIM) lets you make people eligible for a role so they only hold its power when they need it. This guide follows Microsoft’s procedure for assigning Entra roles in PIM, setting how long access lasts, and avoiding the safeguards that can trip you up.

Before you start

• Role: sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
• Licensing: Microsoft’s assignment page doesn’t list licensing requirements, so confirm PIM licensing for your tenant in Microsoft’s licensing documentation before you plan a rollout.

Eligible vs. active assignments

Eligible should be your default for human administrators. Reserve active assignments for accounts that genuinely need constant access.

Step 1: Start an assignment

1. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles.
2. Select Roles, then Add assignments.
3. Select Select a role and choose the role.
4. Choose the member. You can select users, groups, or agent identities.
5. Select Next.

Step 2: Choose the type and duration

1. On the Membership settings pane, set Assignment type to Eligible or Active.
2. Set the duration:
   • Permanent: no expiration, for people who regularly need the role.
   • Time-bound: set start and end dates and times, ideal for temporary or contract workers.
3. Select Assign. A notification confirms the assignment.

Limit the scope of a role

For some roles you can restrict permissions to an administrative unit, service principal, or application:

1. Go to Entra ID > Roles & admins and open the role, for example User Administrator.
2. Select Add assignments and choose the user or group.
3. Pick the scope type and select the administrative unit.

Custom roles that support administrative units must be assigned from within the administrative unit itself, not from the Roles & admins page.

Update or remove an assignment

1. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles.
2. Select the role.
3. On the Eligible roles or Active roles tab, find the assignment.
4. Select Update or Remove.

Rules and safeguards to know

• Minimum duration: an assignment can’t be shorter than five minutes, and it can’t be removed within five minutes of being assigned.
• Guests: assigning a built-in role to a guest gives them the same permissions as a member user.
• Global Administrator lockout protection: an active or eligible time-bound Global Administrator assignment isn’t removed at expiration if it’s the last one of its kind, and you can’t remove the last active or last eligible Global Administrator assignment.
• Emergency access: Microsoft recommends an emergency access account with a permanent active assignment.

Using Microsoft Graph instead

You can automate the same work through the Microsoft Graph API. Microsoft’s page includes examples for creating eligible assignments (roleEligibilityScheduleRequests), creating time-bound active assignments (roleAssignmentScheduleRequests) and removing eligible assignments (AdminRemove).

What happens next

Eligible users activate their role when they need it. Microsoft’s page doesn’t walk through activation, and the default expiration and approval settings live in a separate article on configuring Microsoft Entra admin role settings in PIM, so review those before you roll this out widely.

Sources

• Assign Microsoft Entra roles in Privileged Identity Management – Microsoft Learn