> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/identity/administration/roles/templates/add.md).

# Add PIM Template

Create a PIM role settings template

## Template

| Field         | Description                                                                         |
| ------------- | ----------------------------------------------------------------------------------- |
| Template name | The name shown in the template list and in the PIM Role Settings Template standard. |
| Description   | Optional free text.                                                                 |

## Roles

| Field    | Description                                                                                                                                                                                                                                                                                      |
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Apply to | **Privileged roles** applies the template to CIPP's privileged-roles list (Global, Security, Exchange, SharePoint, User, Conditional Access, Application, ... administrators). **All directory roles** applies it to every role that has a PIM policy. **Custom selection** lets you pick roles. |
| Roles    | The roles for a custom selection.                                                                                                                                                                                                                                                                |

## Activation

| Field                                 | Description                                                                                                                                                          |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Maximum activation duration           | How long an activated role stays active. 8 hours is the recommended maximum; 12 and 24 hours are allowed and logged as an override.                                  |
| Activation requires                   | **Multi-factor authentication**, or a **Conditional Access authentication context** (then enter the context id, for example `c1`). Entra allows only one of the two. |
| Require a ticket number on activation | Adds the ticketing requirement to activation.                                                                                                                        |
| Require approval to activate          | Adds an approval stage. Name the approvers as group display names or user principal names, comma separated; they are resolved in each tenant.                        |

Justification on activation is always required by the secure floor and is not configurable.

## Assignments

| Field                                          | Description                                                                                                                                 |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Maximum eligible assignment duration           | How long an administrator may make someone eligible for; at most one year.                                                                  |
| Maximum active assignment duration             | How long an administrator may assign the role actively for; at most one year. Permanent active assignments become impossible in the portal. |
| Require MFA when creating an active assignment | Adds the MFA requirement to the admin assignment enablement rule. Justification is always required.                                         |

## Notifications

| Field                                    | Description                                                                                                                                         |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| Additional admin notification recipients | E-mail addresses that receive the admin notifications for eligibility, assignment and activation events, in addition to Entra's default recipients. |
| Notification level                       | **All** or **Critical** for the added recipients.                                                                                                   |

{% hint style="warning" %}
Saving a template below the secure floor fails with the list of problems. Fix the settings and save again; CIPP does not adjust them for you.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/identity/administration/roles/templates/add.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.