Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Assign Azure AD Roles Using Privileged Identity Management PIM

Assign Azure AD Roles Using Privileged Identity Management PIM

Written By Jitesh Kumar
Last Updated February 27, 2023
Posted In Azure AD
SHARE

Here’s how you can assign Azure AD Roles using Privileged Identity Management PIM. The Azure AD PIM service also allows Privileged role administrators to make permanent admin role assignments.

A privileged role administrator can customize Privileged Identity Management (PIM) in their Azure Active Directory (Azure AD) organization, including changing the experience for a user who is activating an eligible role assignment.

Privileged Identity Management lets you know when important events occur in your Azure AD organization, such as when a role is assigned or activated. Privileged Identity Management keeps you informed by sending you and other participants email notifications. 

You can manage just-in-time assignments to all Azure AD roles and all Azure roles using Privileged Identity Management (PIM) in Azure Active Directory (Azure AD), part of Microsoft Entra.

Patch My PC
  • Assign: Assign users or current admins as eligible admins for specific Azure AD roles, so that they only have access when necessary.
  • Activate: Activate your eligible admin roles so that you can get limited standing access to the privileged identity.
  • Approve: View and approve all activation requests for specific Azure AD roles that you are configured to approve.
  • Audit: View and export a history of all privileged identity assignments and activations so you can identify attacks and stay compliant.
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.1
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.1

Assign Azure AD Roles Using Privileged Identity Management PIM

Let’s follow the steps to assign Azure AD roles using PIM. With Azure Active Directory, a Global administrator can make permanent Azure AD admin role assignments. 

  • Sign in to the Azure portal with a user in the Privileged Role Administrator role.
  • Open Azure AD Privileged Identity Management > Azure AD roles > Role settings.
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.2
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.2

Select Add assignments to open the Add assignments page, and Select Select a role to open the Select a role page.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.3
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.3

Select Roles to see the list of roles for Azure AD permissions. For Example, I selected BitLocker Recovery Key Reader custom role for assignments.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.4
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.4

Once you selected a role you want to assign, select a member to whom you want to assign the role, Select No member selected the link to open the Select a member or group pane, and then select Next.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.5
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.5

In the Assignment type list on the Membership settings pane, select Eligible or Active.

  • Eligible assignments require the member of the role to perform an action to use the role. Actions might include performing a multi-factor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers.
  • Active assignments don’t require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role at all times.

Add start and end date and time boxes to specify a specific assignment duration. When finished, select Assign to create the new role assignment.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.6
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.6

After the role is assigned, an assignment status notification is displayed. Member ‘Jitesh’ successfully assigned to role ‘BitLocker Recovery Key Reader’ in ‘Directory’.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.7
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.7

Here you can see Azure AD roles have been added to your eligible Azure AD roles.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.8
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.8

When you configure Azure resource role settings, you define the default settings applied to Azure role assignments in Privileged Identity Management (PIM) in Azure AD. Select Edit to open the Edit role setting pane.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.9
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.9

Select the role whose settings you want to configure. The first tab allows you to update the configuration for role activation in Privileged Identity Management.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.10
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.10

Select the Assignment tab or the Next: Assignment button at the bottom of the page to open the assignment setting tab. These settings control role assignments made inside the Privileged Identity Management interface.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.11
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.11

Use the Notification tab or the Next: Activation button at the bottom of the page to get to the notification setting tab for this role. These settings control all the email notifications related to this role. Select Update to update the role settings.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.12
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.12

Activate Azure AD Role

You must activate the role assignment when performing privileged actions if you have been made eligible for an administrative role.

When you need to assume an Azure AD role, you can request activation by opening My roles in Privileged Identity Management.

  • Sign in to the Azure portal. Open Azure AD Privileged Identity Management. You can also directly jump into it by accessing My roles – Microsoft Azure.
  • Select My roles, and then select Azure AD roles to see a list of your eligible Azure AD roles.
  • Here find the role you want to activate and click on Activate.
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.13

If necessary, specify a custom activation start time. The Azure AD role would be activated after the selected time. In the Reason box, enter the reason for the activation request and click on Activate.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.14
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.14

If the role requires approval to activate, a notification will appear in the upper right corner of your browser, informing you the request is pending approval. Here you can see the message Your activation has succeeded.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.15
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.15

Email Notifications for Azure AD Roles

Privileged Identity Management sends emails when the following events occur for Azure AD roles:

  • When a privileged role activation is pending approval.
  • When a privileged role activation request is completed.
  • When Azure AD Privileged Identity Management is enabled.

Who receives these emails for Azure AD roles depends on your role, event, and notification setting.

UserRole activation is pending approvalRole activation request is completedPIM is enabled
Privileged Role Administrator
(Activated/Eligible)		Yes
(only if no explicit approvers are specified)		Yes*Yes
Security Administrator
(Activated/Eligible)		NoYes*Yes
Global Administrator
(Activated/Eligible)		NoYes*Yes
Table 1 –

* If the Notifications setting is set to Enable.

The following shows an example email sent when a user activates an Azure AD role for the organization. Emails sent from Privileged Identity Management for both Azure AD and Azure resource roles have the following sender email address:

  • Email address: azure-noreply@microsoft.com
  • Display name: Microsoft Azure

These emails include a PIM prefix in the subject line. Here’s an example: PIM: Your BitLocker Recovery Key Reader role is now active in Azure Active Directory.

Assign Azure AD Roles Using Privileged Identity Management PIM Fig.17
Assign Azure AD Roles Using Privileged Identity Management PIM Fig.17

Author

About Author – Jitesh, Microsoft MVP, has over six years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus is Windows 10/11 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.

Written by

Jitesh has over 5 years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus area is Windows 10 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Azure AD

Microsoft Azure Removes Default Internet Access for New Virtual Networks

Key Takeaways Here, we are discussing Microsoft Azure Removes Default Internet Access for New Virtual Networks. According to the latest news coming that After March 31, 2026, any newly created Virtual Network (VNet) will no longer have automatic access to the internet. This update was highlighted by Christiaan Brinkhoff on his social media platform. Microsoft […]

AC Anoop C Nair 4 min read
Azure AD

PowerShell Script to Track Upcoming Microsoft Entra App Secret Expirations

PowerShell Script to Track Upcoming Microsoft Entra App Secret Expirations! In this article, I’ll walk you through a powerful automation designed to enhance proactive security and lifecycle management for Microsoft Entra applications. You’ll learn how to monitor Entra app registrations and automate the detection of upcoming secret key expirations, ensuring your identity infrastructure stays secure […]

SN Sujin Nelladath 7 min read
Azure AD

How New TURN Relay IP Range Enhances RDP Shortpath for AVD and Windows 365

Let’s discuss How New TURN Relay IP Range Enhances RDP Shortpath for AVD and Windows 365. Microsoft is going to launch a new improvement on Windows 365 and Azure Virtual Desktop called TURN relay. This is a dedicated IP range across the Microsoft Azure public cloud. TURN Relays new range 51.5.0.0/16 enhances RDP Shortpath connectivity […]

AC Anoop C Nair 4 min read