Symptom
A user has eligible privileged access in Microsoft Entra, but nothing (or not everything) shows up on the Activate PIM Roles page in EasyEntra. In some tenants, the roles do appear, but access in Exchange Online, SharePoint, or OneDrive takes a long time to actually take effect after activation.
Cause
This is almost always a configuration difference, not a bug. Microsoft Entra supports two different ways of using groups with Privileged Identity Management, and they are not interchangeable:
- Eligible role assignment – the group holds permanent members, and the group is assigned the Entra role as eligible. The user activates the role.
- Eligible group membership – the group holds the role permanently, and the user is assigned as an eligible member of the group. The user activates the group membership.
Both eventually grant privileged access, so the two models get treated as equivalent during setup. They are not. EasyEntra activates roles, so eligible group memberships don’t appear on the Activate PIM Roles page. Activation through group membership also propagates more slowly to workloads such as Exchange Online and SharePoint, because the entitlement has to flow through group membership first.
Resolution
Configure PIM using eligible role assignment:
- Create a role-assignable group.
- Add the users as permanent members of the group.
- Assign the Entra role to the group as eligible.
- Configure the activation policy on that eligible assignment.
The users then activate the role itself, which appears on the Activate PIM Roles page and propagates faster across services.
More detail
Both methods are walked through step by step, with screenshots, in this post:
How to Configure Privileged Identity Management for Groups in Microsoft Entra
