Activating eligible Microsoft Entra PIM roles and groups through the official portal can be a painfully slow process. When you are a systems administrator preparing for an urgent maintenance window or responding to a critical security incident, every second counts. Standing administrative access should always be avoided, but obtaining your just-in-time privileges shouldn’t feel like moving through molasses. Learn how to activate Entra ID PIM roles in an efficient way.
What are PIM Roles in Microsoft Entra?
Before we look at how to speed up your workflow, let’s quickly define what PIM roles actually are. PIM stands for Privileged Identity Management. It is a security service in Microsoft Entra ID that helps organizations manage, control, and monitor access to important resources.
Instead of holding powerful administrative permissions all the time, users are granted Eligible assignments. This means their everyday accounts have zero special privileges. When they need to perform a specific administrative task, they must formally activate the role to gain Just-In-Time (JIT) access.
How to Assign PIM Roles in Microsoft Entra ID
Explore the most effective methods to assign Microsoft Entra PIM roles and choose the one that best fits your administrative workflow.
Method 1: Using Microsoft Entra Admin Center
Follow these steps to make a user eligible for a Microsoft Entra administrator role.
- Sign in to the Microsoft Entra admin center using an account with at least the Privileged Role Administrator role.
- Navigate to ID Governance > Privileged Identity Management > Microsoft Entra roles.
- Select Roles to view the available Microsoft Entra administrator roles.
- Select Add assignments to open the Add assignments page.
- Select Select a role, choose the role you want to assign, and then click Next.
- Select the user, group, or agent identity that you want to assign the role to.
- Under Membership settings, choose between appropriate Assignment type: Eligible or Active.
- Specify the assignment duration by selecting the start date and time and end date and time, if required.
- Select Assign to create the new role assignment.
After the role is successfully assigned, an assignment status notification is displayed. If you assign a Microsoft Entra built-in role to a guest user, the guest receives the same permissions as a member user.
Limitation: One of the biggest limitations of the Microsoft Entra portal is its serial activation process. It can process only one activation request at a time, requiring you to wait for Role A to complete before you can navigate through the menus to activate Role B or Group A.
This sequential workflow quickly becomes a bottleneck, especially when:
- You need to activate multiple Microsoft Entra ID and Microsoft 365 roles before you can begin your work.
- An Incident Response team needs immediate access to several privileged roles to contain a security breach.
- A Managed Service Provider (MSP) technician must activate permissions across multiple customer tenants as quickly as possible.
The more roles you need, the more time you spend waiting instead of getting the job done.
Method 2: Using Microsoft Graph PowerShell
If you want to bypass the web interface completely, you can build a custom script using the Microsoft Graph PowerShell SDK. This method allows you to discover assignments and send activation requests directly via code.
First, you must log into Microsoft Graph with permissions to manage directory roles and PIM-governed groups.
# 1. Connect directly to your Microsoft Entra tenant
Connect-MgGraph -TenantId "yourtenant.onmicrosoft.com" -Scopes "RoleManagement.ReadWrite.Directory", "User.Read.All" -NoWelcome
# 2. Define the target user, role, and justification
$UserUPN = "user@yourtenant.onmicrosoft.com" # <-- Replace with the target user's UPN
$RoleName = "Helpdesk Administrator" # <-- Replace with the desired role name
$JustificationReason = "Assigning the role based on an approved access request."
# 3. Retrieve the target user
$User = Get-MgUser -Filter "userPrincipalName eq '$UserUPN'"
# 4. Verify that the user exists
if ($null -eq $User) {
Write-Error "ERROR: Could not find a user with the UPN '$UserUPN'. Please verify the value and try again."
} else {
# Retrieve the role definition
$RoleDef = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq '$RoleName'"
# 5. Configure the PIM assignment request
$params = @{
Action = "AdminAssign"
PrincipalId = $User.Id
RoleDefinitionId = $RoleDef.Id
DirectoryScopeId = "/"
Justification = $JustificationReason
ScheduleInfo = @{
StartDateTime = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ")
Expiration = @{
Type = "AfterDuration"
Duration = "P90D" # Keeps the assignment eligible for 90 days
}
}
}
# 6. Submit the PIM assignment request
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $params
Write-Host "SUCCESS: $UserUPN is now eligible for the $RoleName role!" -ForegroundColor Green
}While PowerShell lets you stay outside the portal, writing a script that loops through multiple roles simultaneously is incredibly difficult. You have to handle separate command workflows for roles versus groups, deal with multi-factor authentication (MFA) prompts mid-script, and build your own error-checking systems to track whether the serial API queue has finished processing your tokens.
Method 3: The EasyEntra Solution (The Fastest Way)
If you want the speed of automation without writing complex lines of PowerShell code, EasyEntra provides a much cleaner solution. Instead of forcing you to activate roles one by one, EasyEntra natively supports Parallel Activation directly inside your administration workspace.
How to Activate Multiple Roles and Groups in EasyEntra
To activate a PIM role, do the following:
- Open the EasyEntra tool, expand the Connection Manager tab, and select Entra ID.
- Right-click on the tenant connection you are working on and select Activate PIM Roles.
- Instead of picking just one item, check the boxes for all the desired roles and groups you need to use.
- Set your target activation duration, type in a business justification, and add an incident ticket number if required.
- Click Activate. EasyEntra will bundle your selections and trigger them all in parallel.
- Once the process wraps up, click Reload to quickly verify that your active status is live across all assignments.
Managing privileged access shouldn’t slow down your work. By enabling parallel activation of multiple PIM roles and groups, EasyEntra removes repetitive steps and helps administrators access the permissions they need in less time.
