A PIM eligible assignment is a Privileged Identity Management role assignment that the holder can activate for a limited time instead of holding permanently; it requires Microsoft Entra ID P2 or Microsoft Entra ID Governance, and it is missed by role counts that list only who holds a role right now. In Microsoft's wording, an eligible assignment requires the user to activate before using the role, while an active assignment grants the role's privileges with no action required. This entry is part of the Orbitra privileged identity glossary.
Why it matters to a lean team
Microsoft recommends PIM so that administrators are eligible rather than permanently active, and states there is no difference in the access given to a permanent versus an eligible holder; the eligible user simply does not hold it all the time. So an eligible Global Administrator counts as a Global Administrator whether or not they are activated when you look. Two limits apply. Microsoft 365 Business Premium and E3 include Entra ID P1, not P2, so many tenants in that range have no eligible assignments at all. And the PIM overview lists Entra roles, Azure resource roles, and groups as what PIM manages, not application permissions, OAuth consent grants, or service principal credentials.
How it shows up in Entra ID and Azure
An assignment can target a user, group, service principal, or managed identity, with a scope, a type (eligible or active), and a duration (start and end dates, or permanent). To activate, the eligible user picks a duration within the administrator-configured maximum and supplies a reason; if approval is required, the request waits for a delegated approver. For Entra roles, only Privileged Role Administrators or Global Administrators can manage PIM assignments for other administrators, and PIM for Entra roles and groups is available through the Microsoft Graph APIs. The Azure side has the reporting gap: Azure Resource Graph queries of role assignments return only active assignments and do not include PIM eligible ones, which must be listed separately through the Entra admin center, PowerShell (Get-AzRoleEligibilityScheduleInstance), or REST.
What to do about it
- Count eligible and active holders together when you inventory a role such as Global Administrator; Microsoft says they grant the same access.
- Keep emergency access accounts permanent active, not eligible. One reason Microsoft gives is a PIM lockout: every Global Administrator and Privileged Role Administrator assignment eligible, approval required, and no active approver.
- Watch the license. When the P2, Governance, or trial license lapses, eligible Entra role assignments and PIM settings are removed; permanent assignments are unaffected.
- Do not treat deactivation as Azure cleanup. Deactivating a PIM Global Administrator assignment does not turn off the "Access management for Azure resources" elevate toggle; Microsoft recommends setting it to No first.
- On P1 only? Read what you can do instead of PIM without Entra ID P2.
Related terms
- Global Administrator
- Privileged Role Administrator
- Emergency access account
- Elevate access
- Service principal
- Privileged identity response
Guides: How many Global Administrators should a Microsoft 365 tenant have and Entra break glass account best practices.
Where Orbitra fits
PIM governs standing versus just-in-time access; Orbitra governs response, working alongside Microsoft native controls at any Microsoft license level. When a privileged identity is compromised, Orbitra calculates identity impact before it acts, every supported response is governed by tenant policy, and it independently re-reads Microsoft after supported response actions to verify the final state. Orbitra tells you which steps are permanent before you approve them; PIM changes are among the actions that cannot be undone. See identity response on Business Premium and E3.
Sources
- What is Microsoft Entra Privileged Identity Management (Microsoft Learn, checked September 2026)
- Microsoft Entra ID Governance licensing fundamentals (Microsoft Learn, checked September 2026)
- Best practices for Microsoft Entra roles (Microsoft Learn, checked September 2026)
- Manage emergency access admin accounts (Microsoft Learn, checked September 2026)
- Elevate access to manage all Azure subscriptions and management groups (Microsoft Learn, checked September 2026)
- Troubleshoot Azure RBAC limits (Microsoft Learn, checked September 2026)