PIM Manager settings · Settings > Automation
Extend ... days before a permission ends
| Key | AutoExtend.LeadDays |
|---|---|
| Where | Settings > Automation > Auto-extend |
| Type | Number |
| Default | 14 days |
| Feature | Admin accounts with the full lifecycle · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
How many days before a time-bound assignment ends the engine renews it (1 to 90). It applies to every expiring delegation PIM manages: group memberships of admins, nested groups, Entra role, administrative-unit and Azure role assignments that are set to auto-extend.
When set
When set: on each engine run, an assignment that ends within this many days and is allowed to extend is renewed for the row's number of days, counted from that run. The 'Upcoming automatic extensions' list and the monthly owner mail show the date each one will be extended. Takes effect on the next engine run.
When blank or default
At the default (14 days): assignments are renewed 14 days before they end.
Risk and how to reverse it
Too short a lead time leaves little room if an engine run fails, so access can lapse. A long lead time renews earlier and gives owners less time to deny. Reversible: change it; the next run uses the new value.
Requires
SuperAdmin to change it. Free (Community) and Pro. The engine needs the same rights it uses to create the assignments (for example RoleManagement.ReadWrite.Directory).
Recommended
Keep 14 days: enough margin for a failed run, and owners still get their monthly list to deny what should end.
Related settings
- Rows without an AutoExtend value are extended AutoExtend.DefaultOn
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack