PIM Manager settings · Operations > Client onboarding

PIM Activator deployment groups (PROD / TEST) and additional tenants

Key	ActivatorTargets
Where	Operations > Client onboarding
Type	Map (one value per item)
Default	No group for PROD or TEST; no additional tenants

What it does

The group that gets the PIM Activator browser extension deployed, one for PROD and one for TEST, picked from your directory, plus an optional list of extra tenants for the extension's catalog. It is about deployment only -- which devices or users Intune and Edge for Business send the extension and its settings to. It does not decide who may sign in to the PIM Activator: what a person can activate is decided by their PIM eligibility. PIM Manager writes nothing to your tenant here: the values are filled into the ready-made commands and the guide on the page.

When set

When a group is set: the Intune command for that channel assigns the settings to that group (and only that group), and the Edge for Business guide names it as the group to assign the policy to. The group is checked in your directory before it is saved. Extra tenants are validated and added to the commands' catalog.

When blank or default

When blank (the default): the Intune command assigns the settings to nobody and says so, and the Edge for Business guide asks you to choose a group. Never all users or all devices.

Risk and how to reverse it

A too-broad group puts the extension on more devices than you meant once an admin runs the command; it gives nobody more access. Changing the group only changes the command text; what is already assigned in Intune or Edge for Business stays until you change it there. Reversible: pick another group or clear it.

Requires

Admin to change it. The Manager needs to read groups in your directory to confirm the group. Running the Intune command needs an Intune Administrator.