> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/identity/administration/roles/role/pim.md).

# PIM Settings

The PIM tab shows how the role is held and the rules Privileged Identity Management applies to it, so a role can be judged on its configuration rather than only on who currently holds it. It opens from the [View Individual Role](/user-documentation/identity/administration/roles/role.md) header tabs and needs a single tenant selected.

Where the tenant is not PIM capable for this role, usually for want of an Entra ID P2 licence, a warning says so and the policy card is left off entirely. Assignments in that case are ordinary directory role memberships: there is no eligibility, no activation limit, and no policy to read.

Where the role's live settings are weaker than CIPP's secure floor, a warning lists each setting that falls short. The floor requires that activation expires within 24 hours and demands multi-factor authentication or an authentication context plus a justification, that eligible and active assignments expire within a year, and that creating an active assignment requires a justification. Entra's own defaults often sit below this.

## Assignment Breakdown

Three cards give the count for each way the role can be held. Selecting a card opens the matching assignments in a drawer, with the same columns and actions as the [Assignments](/user-documentation/identity/administration/roles/role.md#assignments) table on the Overview tab.

| Card                | Description                        |
| ------------------- | ---------------------------------- |
| Permanent           | Active with no end date.           |
| Eligible            | Can activate the role through PIM. |
| Active (time-bound) | Active with an end date.           |

## PIM policy

The role's current PIM settings, read from the tenant. The card header summarises the policy in a line, and a **PIM Templates** button opens the [templates](/user-documentation/identity/administration/roles/templates.md) list. The settings are split into two groups.

**Activation**

| Setting                     | Description                                                                                                                |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Maximum activation duration | How long an activation lasts before it expires.                                                                            |
| Activation requires         | Multi-factor authentication, an authentication context (named where one is set), or None.                                  |
| Justification on activation | Whether the person activating must give a reason.                                                                          |
| Ticket on activation        | Whether a ticket number must be supplied.                                                                                  |
| Approval on activation      | Whether someone must approve the activation. Where approval is required and approvers are set, they are listed underneath. |

**Assignments**

| Setting                                       | Description                                                                                         |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Maximum eligible assignment                   | How long an eligibility can run before it must be renewed.                                          |
| Maximum active assignment                     | How long an active assignment can run before it expires.                                            |
| Justification when creating active assignment | Whether creating an active assignment requires a reason.                                            |
| MFA when creating active assignment           | Whether creating an active assignment requires multi-factor authentication.                         |
| Notification recipients                       | Who is notified about this role's PIM activity, where recipients are configured.                    |
| Meets secure floor                            | Whether the settings above satisfy CIPP's secure floor. The help icon beside it explains the floor. |

Durations are shown in whole units, so `P365D` reads as 1 year and `PT8H` as 8 hours. A setting with no limit reads as no expiration, meaning a permanent assignment is allowed.

## Role Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>Create template from role settings</td><td>Builds a <a href="/user-documentation/identity/administration/roles/templates.md">PIM template</a> from the role's current settings in this tenant, asking for a template name and an optional description. A live policy may sit below the secure floor; a template never stores that, so each offending value is raised to the closest value the floor allows and every raise is listed in the results. Greyed out without role write access, for a role that is not PIM capable, and where CIPP could not read the current policy.</td><td>false</td></tr></tbody></table>

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cipp.app/user-documentation/identity/administration/roles/role/pim.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.