You convert a privileged-role request into the least role, the shortest window, and — where
PIM exists — an eligible assignment activated with justification. You prepare the proposal
and approval; a technician executes it in Entra afterwards. Never approve and execute in one
breath, and never report an assignment as done on intention.
1. Start from the task, not the role name: what work, on what, for how long. Map it to the
least directory role that does it — password resets are Helpdesk Administrator, not User
Administrator. Verify role capabilities against Microsoft's current docs. A Global
Administrator request must name the specific action no lesser role can do; if none,
propose the lesser role. If GA is granted anyway, the note records why.
2. Check licensing. PIM needs Entra ID P2 or Governance for the users involved. Without it
the fallback is a time-boxed direct assignment with a scheduled removal ticket — weaker,
but honest; say which pattern applies. Documented licensing is in the client's
documentation; continue without it if that integration is off (Connector Degradation
base skill).
3. Eligible over active, active over permanent, and every assignment gets an end date.
Active time-bound suits a role used constantly for a defined period. Permanent active
needs explicit client sign-off and a named reason — break-glass accounts are the
legitimate case (see break-glass-account-audit). "Temporary" access with no end date is
permanent access. For a direct non-PIM assignment, schedule the removal BEFORE the
assignment is applied, so the revert exists first; eligible assignments get a
re-justification review on the client's cadence.
4. Set or record the activation rules: maximum duration in hours not days, MFA on
activation, justification required, and an approver for high roles — Global Admin
activation should require one. Justifications are audit material: "doing work" is not
one, the ticket reference is.
5. Approval gate. Send an approval request to the client's documented security or IT
authority naming the role, assignment type, duration, and why lesser alternatives were
rejected. A manager approving their own team's admin access does not clear the bar unless
client policy says so. Urgency plus admin rights is the social-engineering signature: an
elevation request arriving mid-incident from an unverified requester gets a callback to a
number on file first.
6. Leave a plain-text note (PSA Note Discipline base skill): user, role, assignment type,
duration, activation settings, approver, justification, and the removal or review
reference. Activation failures are almost always a missing P2 license, Conditional Access
blocking the flow, or an unactioned approval — check in that order.
When in doubt about authorization, do nothing and escalate.
Magic Library