PIM Manager settings · Settings > Features & edition
Workload connectors: Intune + Defender XDR
| Key | FeatureGates.connectors.workload |
|---|---|
| Where | Settings > Features & edition > Feature customization |
| Type | On / off |
| Default | Off, but on automatically while Intune, Defender XDR or workload assignment rows exist |
| Feature | Entra ID, Azure, Intune and Defender XDR from one model · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
Lets the engine apply your workload role delegation. This covers Intune and Defender XDR role assignments, including Defender custom roles built from a role specification, and the generic workload-connector rows (where Pro connectors also need a licence). If you never set it, it counts as on whenever such assignment rows exist. A value you save always wins.
When enabled
On the next engine run, the engine creates and updates the Intune and Defender XDR role assignments (and custom Defender roles) your definitions describe, and removes the ones your definitions remove. Rows for Pro connectors run only with a Pro licence.
When disabled
The Intune, Defender XDR and workload-connector steps are skipped and reported as not checked, so nothing is assigned or removed there. Groups are still created, and each run warns that their workload role is not being assigned.
Risk and how to reverse it
Switching it on lets the engine write role assignments in Intune and Defender XDR, and remove ones your definitions no longer include. Saving it as off on purpose keeps it off even when rows exist. Reversible: switch it off and the engine stops on its next run, but assignments it already made or removed are not undone.
Requires
Free (Community) for Intune and Defender XDR. SuperAdmin to change it. The engine identity needs DeviceManagementRBAC.ReadWrite.All for Intune and the Defender XDR role management permission for Defender. Each workload's prerequisites must be green before its assignments are applied.
Recommended
Leave it unset (it follows your data) or on if you delegate Intune or Defender roles. Switch it off only to pause workload changes.
Related settings
- Workload exemptions WorkloadExemptions
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack