Privileged Identity Management
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit cae26f8 · +8 −8 lines · also on GitHub
⋯ 39 unchanged lines
4040
- Get **notifications** when privileged roles are activated
4141
- Conduct **access reviews** to ensure users still need roles
4242
- Download **audit history** for internal or external audit
43
−- Prevents removal of the **last active Global Administrator** and **Privileged Role Administrator** role assignments
43
+- Prevent removal of the **last active Global Administrator** and **Privileged Role Administrator** role assignments
4444
4545
## What can I do with it?
4646
⋯ 27 unchanged lines
7474
7575
## Role assignment overview
7676
77
−The PIM role assignments give you a secure way to grant access to resources in your organization. This section describes the assignment process. It includes assign roles to members, activate assignments, approve or deny requests, extend and renew assignments.
77
+The PIM role assignments give you a secure way to grant access to resources in your organization. This section describes the assignment process. It includes assigning roles to members, activating assignments, approving or denying requests, and extending and renewing assignments.
7878
79
−PIM keeps you informed by sending you and other participants [email notifications](pim-email-notifications.md). These emails might also include links to relevant tasks, such activating, approve or deny a request.
79
+PIM keeps you informed by sending you and other participants [email notifications](pim-email-notifications.md). These emails might also include links to relevant tasks, such as activating, approving, or denying a request.
8080
8181
The following screenshot shows an email message sent by PIM. The email informs Patti that Alex updated a role assignment for Emily.
8282
⋯ 5 unchanged lines
8888
8989
- The members or owners to assign the role.
9090
- The scope of the assignment. The scope limits the assigned role to a particular set of resources.
91
−- The type of the assignment
92
− - **Eligible** assignments require the member of the role to perform an action to use the role. Actions might include activation, or requesting approval from designated approvers.
91
+- The type of the assignment.
92
+ - **Eligible** assignments require the member of the role to perform an action to use the role. Actions might include activation, or requesting approval from designated approvers.
9393
- **Active** assignments don't require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role.
94
−- The duration of the assignment, using start and end dates or permanent. For eligible assignments, the members can activate or requesting approval during the start and end dates. For active assignments, the members can use the assigned role during this period of time.
94
+- The duration of the assignment, using start and end dates or permanent. For eligible assignments, the members can activate or request approval during the start and end dates. For active assignments, the members can use the assigned role during this period of time.
9595
9696
The following screenshot shows how administrator assigns a role to members.
9797
9898
:::image type="content" source="./media/pim-configure/role-assignment.png" alt-text="Screenshot of Privileged Identity Management role assignment.":::
9999
100100
101
−For more information, check out the following articles: [Assign Microsoft Entra roles](pim-how-to-add-role-to-user.md), [Assign Azure resource roles](pim-resource-roles-assign-roles.md), and [Assign eligibility for a PIM for Groups](groups-assign-member-owner.md)
101
+For more information, check out the following articles: [Assign Microsoft Entra roles](pim-how-to-add-role-to-user.md), [Assign Azure resource roles](pim-resource-roles-assign-roles.md), and [Assign eligibility for a PIM for Groups](groups-assign-member-owner.md).
102102
103103
### Activate
104104
⋯ 9 unchanged lines
114114
115115
### Approve or deny
116116
117
−Delegated approvers receive email notifications when a role request is pending their approval. Approvers can view, approve, or deny these pending requests in PIM. After the request is approved, the member can start using the role. For example, if a user or a group was assigned with Contribution role to a resource group, they are able to manage that particular resource group.
117
+Delegated approvers receive email notifications when a role request is pending their approval. Approvers can view, approve, or deny these pending requests in PIM. After the request is approved, the member can start using the role. For example, if a user or a group was assigned with Contribution role to a resource group, they can manage that particular resource group.
118118
119119
For more information, check out the following articles: [Approve or deny requests for Microsoft Entra roles](./pim-approval-workflow.md), [Approve or deny requests for Azure resource roles](pim-resource-roles-approval-workflow.md), and [Approve activation requests for PIM for Groups](groups-approval-workflow.md)
120120
⋯ 44 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.