PIM Manager documentation · Verified against PIM Manager 3.0.23.3 on Nov 3, 2026

FAQ

Short answers to the questions customers ask most: about buying and running PIM Manager, how it behaves in a live tenant, and the support cases that come up most often.

Buying and running

What does it cost to run?

Three parts make up the cost:

PIM Manager. The Community edition is free for one tenant. Pro editions are priced on invardia.com/pricing.
Azure. PIM Manager runs in your own subscription, so the Azure resources are on your Azure bill. See Sizing.
Microsoft licenses. PIM itself needs Microsoft Entra ID P2 or Microsoft Entra ID Governance. See Microsoft licenses you need.

What happens when a Pro license ends?

Pro keeps working through a grace period of 30 days, unless the license names another period. Then the installation continues as Community. You are not locked out: a SuperAdmin keeps full access, and your data stays readable. See Platform and editions.

Where is my data?

In the Azure SQL database in your own subscription, in the region you install to. What the product sends to Invardia, and how to switch it off, is on Data.

How do I stop using PIM Manager?

Uninstalling PIM Manager does not undo what it built in your tenant: groups, nestings, role assignments and admin accounts stay as they are, and keep working in Microsoft Entra PIM. The steps to remove the installation, and what each step deletes, are in Setup: Remove it. Then remove the PIM Activator app registration and the extension policy if you no longer use them.

Remove-PimContainerStack is not an uninstall: it removes only the Container Apps part, so that you can deploy again with another exposure, and keeps the database and the other resources.

Groups and nesting

Why must a role group be role-assignable?

A group that holds an Entra role must be role-assignable, or Microsoft Entra refuses the role. A role group nested into such a group gives the same role, so it needs the same protection: in a role-assignable group, only a Global Administrator, a Privileged Role Administrator or the group’s owner can change the members. Without the flag, a Groups Administrator or User Administrator could add themselves to the role group and gain the Entra role. Microsoft does not require the flag on the role group; PIM Manager does, and locks that choice in its wizards. See Role-assignable groups.

Can I make a group role-assignable later?

No. Microsoft sets the flag only when the group is created, and a tenant can hold at most 500 role-assignable groups. PIM Manager decides the flag from your design when it creates the group, and sets it on a Tier-0 role group from the start, because it cannot be added later.

Why can a nesting into a role-assignable group only be Eligible?

Microsoft Entra refuses an Active group membership in a role-assignable group through PIM for Groups (“Nesting is currently not supported”). PIM Manager therefore writes such a nesting as Eligible. If a row asks for Active, the item is reported under Jobs > Engine logs & errors with a Make it Eligible fix.

Why nest groups at all?

Ten engineers who each need 20 Entra roles and 5 Azure roles at 3 management groups need 350 direct assignments. With admin, role group and permission groups, the same access takes 70: 10 admin memberships, 25 permission groups in the role group, and 35 assignments to the targets (20 Entra roles, and 5 Azure roles at 3 management groups each). Adding or removing one engineer is 1 change instead of 35. See Nested groups.

Changes outside PIM Manager

What happens if I change a group outside PIM Manager?

PIM Manager keeps your tenant in line with what it defines:

A membership or assignment it defines that someone removed is shown as missing. Apply now on the Drift page has the engine create it again, or Ignore accepts the difference.
A policy setting someone changed in the portal is shown as changed. Putting it back is a policy change, which waits for a SuperAdmin’s approval (see Guards).
Something someone added that PIM Manager does not define is shown as extra. You decide: Import into PIM (stages a row that defines it), Delete (a SuperAdmin; queued and committed, then removed by the engine; an extra assignment needs a Pro edition; in Community, remove it in the Microsoft Entra admin center or the Azure portal) or Ignore. An ignored finding comes back with Re-add. PIM Manager does not remove an extra automatically. See How to handle drift.

How is drift shown?

On Reviews & controls > Drift: live vs desired. Per area, it lists the desired, live and in-sync counts, and the missing, changed and extra items. The check runs on a schedule in the background, so the page opens at once; a button at the top runs it on demand. A drift mail goes to you on the cycle you choose there.

Does PIM Manager touch groups it does not define?

Not automatically. The engine changes a policy, group, admin or assignment only when your data defines it. Groups, roles and admins that no row names are left alone by every engine run, reconcile and offboarding, and break-glass accounts are not disabled, revoked or offboarded. An offboarding removes memberships only in groups PIM Manager defines.

A person can still act on them: a SuperAdmin can delete an extra group on the Drift page, or revoke an assignment PIM Manager does not manage on Delegation overview (Pro; in Community, remove it in the Microsoft Entra admin center or the Azure portal). Both go through a commit and the guards. A group whose name matches a definition is adopted by that definition; see Before you adopt a group.

What happens if the database is empty?

Nothing. If the database defines nothing, or the engine cannot count what it defines, every scope is skipped and the engine reads and writes nothing. A fresh install, a failed import or a wiped database is not read as “remove everything”.

Does PIM Manager change PIM policies by itself?

No. You choose each policy setting on Templates > Policy settings. A setting without a choice is left as it is, and every change set waits for a SuperAdmin’s approval of that exact set. That SuperAdmin may be the one who saved the choices; see Who may approve.

Identity and installation

Which permissions does the engine need?

Microsoft Graph application permissions to manage groups, users, role assignments and PIM policies, plus Reader in Azure and, if it manages Azure roles, User Access Administrator or Owner at the scopes you choose. These rights are Tier-0 equivalent, so treat the engine identity as a Tier-0 asset. The one list, with the reason for each permission and who grants it, is on Engine permissions. Get Started > Engine permissions compares it with what your installation holds.

Does PIM Manager need PowerShell modules?

No. The engine talks to Microsoft Graph and Azure Resource Manager directly through REST. The scripts you run to set up PIM Manager or the PIM Activator need no PowerShell modules either; they open a browser sign-in themselves.

No client secret is needed for sign-in. The sign-in front proves itself with a managed identity’s federated credential and keeps your session on the server.

The install does create one client secret, valid for 2 years, for the built-in Azure Container Apps sign-in it falls back to if the sign-in front does not answer. The front does not use it, and it stays on the sign-in app registration and in the container app until you remove it: see Remove the old sign-in secret.

Can I deploy the PIM Activator without Intune?

Yes, with one script per machine or a Group Policy Object. See PIM Activator.

Support cases

A new Edge profile does not have the PIM Activator

Edge for Business installs the extension only in profiles signed in with the work account. In the new profile, select the profile picture, then Sign in, and sign in with the work account. The extension installs by itself within a few minutes. InPrivate and Guest windows do not run extensions.

The symptom is a sign-in that hangs, or a browser error such as an HTTP/2 protocol error on the sign-in page, while the same account signs in fine from outside. Some proxies drop a request whose headers are larger than their limit, and the browser shows that as a protocol error. Admins in many groups carry large sign-in data. PIM Manager’s sign-in front keeps the session on the server and gives the browser only a small cookie. If the error stays, check the header size limit and any TLS inspection rule for the PIM Manager address on your proxy, and contact support.

PIM Manager does not resolve on a private network

A private installation uses Azure private DNS zones. A network that uses its own DNS servers, such as domain controllers, does not see those zones. On your DNS servers, add a conditional forwarder for the zones PIM Manager prints: from a DNS server in Azure, forward to Azure’s own DNS and link the zones to that server’s virtual network; from on-premises, forward to an inbound endpoint of an Azure DNS Private Resolver. PIM Manager prints the records and forwarders; it does not write to your DNS. A hosts-file entry only helps on a single machine, for a quick check.

Which mailbox sends PIM Manager’s mail?

A shared mailbox in your tenant, named by you under Get Started > Mail sender (by default PIM-Engine with the display name PIM Manager). It needs no license and no password. PIM Manager sends as that one mailbox through an Exchange Online application role scoped to it. The setup script removes a tenant-wide Mail.Send grant from the engine’s and the Manager’s identities, because such a grant would let them send as any mailbox. The hybrid worker is the exception; see Hybrid Active Directory. Your tenant needs an Exchange Online plan, and the person who runs the setup needs an active Exchange Administrator role. Get Started > Mail sender shows the two-line command with your values; it runs Initialize-PimMailSender. Then press Check and send a test mail.

Mail fails right after setup on a new tenant

Exchange Online applies a new application role assignment with a delay, which can take up to about two hours, and a new Exchange organization needs time before it accepts changes at all. The setup script waits and retries. If the test mail still fails, wait and send it again. Do not add broader Exchange roles to work around it.

An activation is refused because the duration is too long

The error says the duration in the request is greater than the maximum allowed duration. The role’s PIM policy allows less than you asked for. The PIM Activator reads that role’s maximum, activates it for the maximum and tells you on the row. If it cannot read the maximum, lower Duration (hours) and try again. In the engine, the same refusal on an assignment has a Make it Eligible fix, or you shorten the assignment or change the policy template.

The auto-activation cap works on one device but not another

The PIM Activator has two channels, the released extension and TEST, a second extension you can use to try an update on a few machines first, each with its own extension id. The Intune Remediation and Deploy-PimActivatorClient.ps1 write the same limits for both ids. A device whose settings came from an earlier Remediation can have them for one id only. Publish the Remediation again with Publish-PimActivatorRemediation. To check a device, open edge://policy, press Reload policies, and look for the setting with the status OK.

The engine still gets “access denied” after a permission was granted

A managed identity keeps its old permissions in its token for a while after a grant, usually up to about an hour. Wait for a later run. If the error stays, the item says The engine identity lacks a permission: open Get Started > Engine permissions and run the command shown, as a Privileged Role Administrator (a Global Administrator also can).

A commit only starts at the next scheduled run

A commit starts the engine at once only when the Manager’s identity may start the engine job. It needs the Azure role Container Apps Jobs Operator on the engine job, and nothing wider. Without it, the commit waits for the next scheduled run. The setup script Initialize-PimHostingAccess.ps1 from the release package grants this role on the engine job only, for the Manager’s identity. It also brings the other standard rights of the engine’s and the Manager’s identities up to date on an existing installation; add -SkipGraph to leave their Graph permissions as they are. Run it with -SubscriptionId, -ResourceGroup, -SqlServerFqdn and -TenantId of your installation, first with -WhatIf to see what it would change.

“Two groups carry the same name”

PIM Manager does not guess which of two groups with the same name it manages, so it changes neither. The item names both. Rename or delete the wrong one in the Microsoft Entra admin center. The same applies to two administrative units with one name.

“The group is not role-assignable”

An Entra role was given to a group created without the flag, which cannot be added later. Set role-assignable to Yes on the group’s definition and delete the group in Entra ID; the engine creates it again as role-assignable. Or give the role to a role-assignable group.

“Not visible yet” right after a change

Microsoft Entra takes a few minutes to make a new account, group or role visible to every service. Nothing is wrong; the next run applies the item. If it stays for hours, check that the object still exists.

A token issued before you were added to the database’s SQL admin group does not carry the new membership. Sign out and sign in again. If it stays, check that your account is in the SQL admin group with Initialize-PimSqlAdminGroup. See SQL access.

What does a guard do when it holds?

It writes nothing of the held plan and lets the rest of the run go ahead. A SuperAdmin approves or releases that exact plan, or you fix the definitions and the hold clears by itself. See Guards.

The engine job ran out of memory

A large tenant needs more memory for the engine job. With updates on, the next update gives the job more memory. To do it at once, raise the engine job’s CPU and memory with your Azure administrator. See Sizing.

Does offboarding delete the account?

No. By default, offboarding disables the account and nothing more. With Automatic offboarding on (off by default), it also revokes the account’s sessions and removes its memberships and eligibilities in groups PIM Manager defines. The account is kept. Only Delete account, chosen by a person, deletes it. See How to offboard an admin.

Verified against PIM Manager 3.0.23.3 on Nov 3, 2026Download PDF

FAQ