PIM Manager settings · Settings > Automation
Discovery: what happens with a newly discovered resource
| Key | DiscoveryAutoCreate |
|---|---|
| Where | Settings > Automation > Discovery: new resources |
| Type | Map (one value per item) |
| Default | Report only, for every type of resource |
| Feature | An engine that keeps your tenant matching your model · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
Per type of resource the discovery sweep can find -- an Azure subscription, a management group, a resource group, a Power BI workspace -- you choose what PIM Manager does with a new one: report it only, stage a group definition for your review, or queue the creation of its delegation group as a normal change.
When set
When a type is set to 'Stage for review': a definition row for the new resource is staged on Pending changes and nothing happens until an administrator commits it. When set to 'Create automatically': the creation is queued as a change and the engine creates the group without a person committing it.
When blank or default
For a type left on 'Report only' (the default): a new resource is recorded in the audit trail. Nothing is staged or created.
Risk and how to reverse it
Create automatically means groups appear in Microsoft Entra ID because somebody created a resource -- for example a test subscription -- with no administrator involved. Stage for review keeps a person in the decision. Reversible: set the type back; groups already created stay.
Requires
SuperAdmin to change it. Pro, and the discovery sweep switched on (Settings > Features & edition).
Recommended
Report only, or Stage for review for the types you always want managed. Use Create automatically only where every new resource of that type must be governed from its first day.
Related settings
- Discovery sweep FeatureGates.discovery.sweep
- Scheduled jobs FeatureGates.scheduler.jobs
- Jobs FeatureFlags.jobs
- Direct-group types -- Tag prefix NamingConventions.GroupTypePrefixes
- Direct-group types -- Administrative unit NamingConventions.GroupTypeAdminUnits
- Permission-group administrative units NamingConventions.PermissionGroupAdminUnits
- PimGroupPattern (PIM group name) NamingConventions.PimGroupPattern
- PimGroupAuPattern (AU-scoped group name) NamingConventions.PimGroupAuPattern
- PimGroupTagRegex (strict tag check) NamingConventions.PimGroupTagRegex
- AdminUnitNamePattern (administrative unit name) NamingConventions.AdminUnitNamePattern
- Send a mail about newly discovered resources to DiscoveryNotifyRecipients
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack