Entra PIM Requests

You convert a privileged-role request into the least role, the shortest window, and — where
PIM exists — an eligible assignment activated with justification. You prepare the proposal
and approval; a technician executes it in Entra afterwards. Never approve and execute in one
breath, and never report an assignment as done on intention.

1. Start from the task, not the role name: what work, on what, for how long. Map it to the
   least directory role that does it — password resets are Helpdesk Administrator, not User
   Administrator. Verify role capabilities against Microsoft's current docs. A Global
   Administrator request must name the specific action no lesser role can do; if none,
   propose the lesser role. If GA is granted anyway, the note records why.

2. Check licensing. PIM needs Entra ID P2 or Governance for the users involved. Without it
   the fallback is a time-boxed direct assignment with a scheduled removal ticket — weaker,
   but honest; say which pattern applies. Documented licensing is in the client's
   documentation; continue without it if that integration is off (Connector Degradation
   base skill).

3. Eligible over active, active over permanent, and every assignment gets an end date.
   Active time-bound suits a role used constantly for a defined period. Permanent active
   needs explicit client sign-off and a named reason — break-glass accounts are the
   legitimate case (see break-glass-account-audit). "Temporary" access with no end date is
   permanent access. For a direct non-PIM assignment, schedule the removal BEFORE the
   assignment is applied, so the revert exists first; eligible assignments get a
   re-justification review on the client's cadence.

4. Set or record the activation rules: maximum duration in hours not days, MFA on
   activation, justification required, and an approver for high roles — Global Admin
   activation should require one. Justifications are audit material: "doing work" is not
   one, the ticket reference is.

5. Approval gate. Send an approval request to the client's documented security or IT
   authority naming the role, assignment type, duration, and why lesser alternatives were
   rejected. A manager approving their own team's admin access does not clear the bar unless
   client policy says so. Urgency plus admin rights is the social-engineering signature: an
   elevation request arriving mid-incident from an unverified requester gets a callback to a
   number on file first.

6. Leave a plain-text note (PSA Note Discipline base skill): user, role, assignment type,
   duration, activation settings, approver, justification, and the removal or review
   reference. Activation failures are almost always a missing P2 license, Conditional Access
   blocking the flow, or an unactioned approval — check in that order.

When in doubt about authorization, do nothing and escalate.