Microsoft Entra Privileged Identity Management (PIM) offers multiple ways to provide just-in-time (JIT) administrative access. When using groups together with Microsoft Entra roles, administrators often encounter two seemingly similar approaches:
- Assigning users as permanent members of a group eligible for Microsoft Entra roles
- Assigning users as eligible members of a group with permanent Microsoft Entra roles
Although both methods eventually allow users to activate privileged access, they operate differently and are intended for different scenarios. Choosing the appropriate model helps reduce activation delays, simplifies administration, and ensures compatibility with management tools.
Let’s look at how each model works and when you should use them.
Two Ways to Configure PIM for Groups in Microsoft Entra ID
Microsoft supports two ways to provide privileged access through role-assignable groups. Although the end result is the same, the activation target is different. Understanding the difference is important because it affects both the user experience and compatibility with EasyEntra.
Method 1. Active Group Membership + Eligible Role Assignment
In this model,
- Users are permanent members of a role-assignable security group.
- The group itself is assigned to the Microsoft Entra role as an eligible assignment.
- When users activate PIM, they activate the directory role, not their membership in the group.
Here, the group membership never changes. Only the role assignment is activated.
How to Configure Eligible Role Assignment in Microsoft Entra PIM
Follow these steps to configure a role-assignable group with an eligible Microsoft Entra role assignment in Microsoft Entra PIM.
Step 1: Create a Role-Assignable Group
- Sign in to the Microsoft Entra admin center.
- Go to Identity > Groups > All groups and click New group.
- Set Group type to Security and enter a group name.
- Toggle Microsoft Entra roles can be assigned to the group to Yes.
- Click Create.
Step 2: Add Permanent Members
- Open your newly created group and select Members from the left menu.
- Click Add members.
- Add the administrators who will use this role and click Select.
Step 3: Assign the Role as Eligible
- Navigate to Identity Governance > Privileged Identity Management > Microsoft Entra roles.
- Click Roles under the Manage menu.
- Search for your target role (e.g., Exchange Administrator) and click on it.
- Click Add assignments from the top bar.
- Under Select member(s), select your role-assignable group and click Next.
- Set the Assignment type to Eligible and click Assign.
Step 4: Configure the Activation Policy
- Inside the specific role view, click Role settings from the top menu.
- Click Edit to configure activation rules (e.g., require MFA, Justification, or Approvers).
- Click Update to save.
How to Activate Eligible Group Roles via EasyEntra
Once you’ve configured the role-assignable group with an eligible Microsoft Entra role assignment, users can activate their eligible Microsoft Entra roles directly from EasyEntra. Follow these steps:
- Open the EasyEntra tool, expand the Connection Manager tab, and select Entra ID.
- Right-click on the tenant connection you are working on and select Activate PIM Roles.
- Check the boxes for all the desired roles you need to use. Set your target activation duration, type in a business justification, and add an incident ticket number if required.
- Click Activate. EasyEntra will bundle your selections and trigger them all in parallel.
- Once the process wraps up, click Reload to quickly verify that your active status is live across all assignments.
Important: This is the recommended configuration for most organizations as role activation across services like Exchange Online and OneDrive is faster. Also, this is the model that EasyEntra's Activate PIM Roles feature is designed to work with. ✅
Method 2. Eligible Group Membership with Active Role Assignment
In this model,
- The group permanently holds the Microsoft Entra role.
- Users are eligible members of the group.
- When users activate PIM, they temporarily become members of that group.
Here, the role assignment never changes. Instead, the user’s membership in the group changes.
How to Configure Eligible Group Membership in Microsoft Entra PIM
Follow these steps to configure a permanently assigned Microsoft Entra role while allowing users to activate eligible group membership through PIM.
Step 1: Create a Role-Assignable Group
- Go to Identity > Groups > All groups and click New group.
- Set Group type to Security and enter a group name.
- Toggle Microsoft Entra roles can be assigned to the group to Yes.
- Click Create.
Step 2: Assign the Role Permanently to the Group
- Navigate to Identity > Roles & admins > Roles & admins.
- Search for your target role (e.g., SharePoint Administrator) and click on it.
- Click Add assignments.
- Under Select member(s), select your newly created group and click Next.
- Set the Assignment type to Active and click Assign.
Step 3: Assign Users as Eligible Members
- On the PIM Groups dashboard, click on your group name.
- Select Assignments from the left menu and click Add assignments.
- Choose Member in the role dropdown.
- Under Select member(s), choose your target users and click Next.
- Set the Assignment type to Eligible and click Assign.
Step 4: Configure the Group Activation Policy
- Inside your PIM Group menu, click Settings under the Manage section.
- Click on the Member role string.
- Click Edit to set up membership rules (e.g., require MFA, Justification, or Approvers).
- Click Update to save.
Important: EasyEntra does not support activation of eligible group memberships with active role assignments. Since users activate group membership rather than the Microsoft Entra role itself, these assignments won't appear on the Activate PIM Roles page. ❌
Key Differences Between the Two Models
The following comparison highlights how these two PIM models differ in configuration, activation, and day-to-day administration.
| Feature | Method 1 | Method 2 |
|---|---|---|
| 1. Group membership | Permanent | Temporary during activation |
| 2. Role assignment | Eligible | Active |
| 3. What PIM activates | Microsoft Entra role | Group membership |
| 4. User becomes group member during activation | No | Yes |
| 5. Microsoft Entra role becomes active during activation | Yes | No (already active on the group) |
| 6. Activate PIM Roles via EasyEntra | Supported | Not supported |
Microsoft recommends the same model EasyEntra uses when assigning PIM access to Exchange or SharePoint. Activating groups (instead of roles) may carry considerable delays before access is actually granted in these services: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/concept-pim-for-groups#make-a-group-of-users-eligible-for-a-microsoft-entra-role
