Documentation
PIM Manager error codes
Each code PIM Manager names in a mail, a run log or a ticket, with what it means and what to do. Quote the code when you contact support.
- pim-ad-0101 The hybrid worker may not delete groups in Active Directory
- pim-az-0101 Azure PIM policy rule(s) did not apply
- pim-az-0102 Placeholder subscription -- this row was never filled in
- pim-az-0103 Subscription not found
- pim-az-0104 Azure PIM policy template requires approval, but no approver resolved
- pim-az-0105 Azure PIM policy approval kept (not in the template)
- pim-az-0106 Azure PIM policy rejects the assignment duration
- pim-az-0107 Azure PIM policy requires MFA -- the engine can never satisfy it
- pim-az-0108 Azure role name does not exist at this scope
- pim-az-0109 Discovery: Azure not visible
- pim-az-0110 Azure did not answer the role lookup
- pim-def-0101 The Defender XDR role was created and is not listed yet
- pim-def-0102 Defender XDR refused a permission its prerequisite is missing for
- pim-def-0103 Two Defender XDR roles share this name -- PIM will not pick one
- pim-def-0104 A Defender XDR role of this name exists and was not created by PIM Manager -- not changed
- pim-def-0105 The Defender XDR assignment is shared with other principals
- pim-eng-0101 The engine job ran out of memory
- pim-eng-0102 The run ended without recording its result
- pim-eng-0103 The engine identity lacks a permission
- pim-eng-0104 Throttled by Microsoft
- pim-eng-0105 Microsoft service error
- pim-eng-0106 The scheduled execution stopped while the job was running
- pim-eng-0107 The job could not sign in this time
- pim-eng-0201 A committed change is not in place in the tenant
- pim-entra-0101 The row names an Entra role this tenant does not have
- pim-entra-0102 The group is not role-assignable, so Entra refuses the role
- pim-entra-0103 Two administrative units in Entra ID carry the same name -- PIM Manager touches neither
- pim-entra-0104 Entra group, administrative unit or role could not be resolved
- pim-entra-0105 Active group nesting into a role-assignable group -- Entra refuses it
- pim-entra-0106 The account or group was created moments ago and PIM cannot see it yet
- pim-entra-0107 An object this run created is not visible to Microsoft Entra yet, so the step that uses it waits
- pim-entra-0108 An AU-scoped role row is in the tenant-wide role entity -- refused
- pim-gen-0001 An engine problem PIM Manager has not classified yet
- pim-gen-0002 A row or setting cannot be applied as written
- pim-gen-0003 A row names something that does not exist in the tenant
- pim-gen-0004 An object is not visible at Microsoft yet
- pim-gen-0005 Microsoft asked PIM Manager to slow down
- pim-gen-0006 A Microsoft service error
- pim-gen-0007 A large change is held for approval
- pim-gen-0008 A committed change is not in place in the tenant
- pim-gen-0009 A permission is missing
- pim-gen-0010 A run was stopped before it finished
- pim-gen-0011 The engine job needs more resources
- pim-gen-0012 The tenant lacks the Microsoft service a step needs
- pim-gen-0013 The tenant lacks the data a step reads
- pim-gen-0014 A run result could not be saved in the store
- pim-grd-0101 Azure PIM policy changes HELD by the mass-change circuit breaker
- pim-grd-0102 PIM for Groups policy changes HELD by the mass-change circuit breaker
- pim-grd-0103 Entra role policy changes HELD by the mass-change circuit breaker
- pim-grd-0104 Removals held -- more than the per-run removal budget in one scope
- pim-grp-0101 Two groups in Entra ID carry the same name -- PIM Manager touches neither
- pim-grp-0102 The new group's PIM policy is not ready for this rule yet
- pim-grp-0103 The group this item needs does not exist yet
- pim-grp-0104 The group's PIM policy could not be read, so nothing was written
- pim-grp-0105 A group with a defined name exists, but PIM Manager did not create it -- it waits for an administrator
- pim-pbi-0101 PIM Manager is not in this Power BI workspace yet
- pim-pbi-0102 PIM Manager cannot use the Power BI admin API yet
- pim-pbi-0103 The Power BI workspace was not found
- pim-tap-0101 The admin account is not created yet, so its Temporary Access Pass waits
- pim-tap-0102 The tenant TAP policy refused the Temporary Access Pass request
- pim-tap-0103 No one to send the Temporary Access Pass to
- pim-upd-0101 The update did not reach every part of PIM Manager
- pim-upd-0102 No Pro licence is installed, so the Pro update was not fetched
- pim-upd-0103 The new version was built, but the registry did not accept it
- pim-wl-0101 Removing this workload binding needs data the row does not have
- pim-wl-0102 Workload row names a connector that does not exist
- pim-wl-0103 Workload role name does not exist
- pim-wl-0104 Workload row names a group that does not exist
- pim-wl-0105 Workload row is missing its Resource
- pim-wl-0106 The group is not provisioned in the workload yet
- pim-wl-0107 Workload row cannot be applied as written