Skip to content
InvardiaInvardia
Why InvardiaProductsFeaturesPricingCommunity
Docs
All documentation
Product documentationPIM ManagerSecurityInsight
SettingsPIM Manager settingsSecurityInsight settingsEntra Policy Suite settings
ScriptsPIM Manager scriptsSecurityInsight scriptsEntra Policy Suite scriptsInvardia scripts
Error codesPIM Manager error codesSecurityInsight error codes
API and MCPPIM Manager APIPIM Manager MCP toolsSecurityInsight APISecurityInsight MCP tools
SecurityPIM Manager security packSecurityInsight security packEntra Policy Suite security pack
Network and designPIM Manager network guidesPIM Manager command wizardNetwork egressDesign your installationCalculate your cost
SupportSetup scriptsRemote support access
Search the docs
SupportAboutContactBook a demoCustomer portalDesign your installationFree Pro trial

PIM Manager settings · Settings > Features & edition

Workload connectors: app-role, Azure DevOps, Dataverse, Business Central, Power Platform

KeyFeatureGates.connectors.apps
WhereSettings > Features & edition > Feature customization
TypeOn / off
DefaultOff, but on automatically while app-role or workload assignment rows exist
FeatureMore workloads: Power BI, enterprise apps, Azure DevOps, Dataverse and more · Pro Business, Pro Enterprise, Pro MSP
ConfirmationPIM Manager asks you to confirm before it is switched on.

What it does

The switch for the enterprise-app app-role connector. The engine applies app-role assignments from your app-role definitions only when it is on. Azure DevOps, Dataverse, Business Central and Power Platform rows actually run under 'Workload connectors: Intune + Defender XDR' and need the Pro licence this entry names. This switch does not stop them.

When enabled

On the next engine run, the engine assigns the enterprise-application app roles your definitions describe, and removes the ones they no longer include, if a Pro licence is installed.

When disabled

The app-role step is skipped and reported as not checked. Azure DevOps, Dataverse, Business Central and Power Platform rows still run if the Intune + Defender XDR switch is on and a Pro licence covers them.

Risk and how to reverse it

Switching it on lets the engine grant and remove app-role assignments on enterprise applications. Switching it off does not pause the other connectors in its label. Use the Intune + Defender XDR switch, or remove the rows, for that. Reversible: the engine stops on its next run, and assignments already made stay.

Requires

A Pro licence (switching it on without one is refused, and rows are held). SuperAdmin to change it. The engine identity needs AppRoleAssignment.ReadWrite.All and Application.Read.All for app roles.

Recommended

On when you manage app-role delegation with PIM Manager. Otherwise leave it unset.

Related settings

  • Power BI integration FeatureGates.connectors.powerbi

Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack

InvardiaInvardia

See the risk. Control the access.

Products

PIM ManagerSecurityInsightEntra Policy SuiteAll featuresPricingFree 60-day Pro trialBook a demoWhy Invardia

Docs

DocumentationSearch the docsPIM Manager settingsSecurityInsight settingsPIM network guidesCommand wizardNetwork egressPIM Manager design configuratorSecurityInsight design configuratorDesign your installationCalculate your cost

Company

AboutContactCustomer portalSupportHow support worksHow updates reach youSupport in numbersSetup scriptsRemote support accessContact: info@invardia.com

Legal

Terms of saleLicence termsData processingPrivacyCookiesCompany information
© 2026 Invardia – a brand of 2LINKIT, founded and owned by Morten Knudsen · Strandvejen 21A, 6000 Kolding, Denmark · VAT DK39208032 · Contact: info@invardia.com