PIM Manager settings · Settings > Features & edition
Discovery sweep
| Key | FeatureGates.discovery.sweep |
|---|---|
| Where | Settings > Features & edition > Feature customization |
| Type | On / off |
| Default | Off |
| Feature | An engine that keeps your tenant matching your model · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
Lets the engine look for resources it does not manage yet. At the end of each engine run it lists your Azure subscriptions and management groups (and Power BI workspaces when that integration is on), and the daily discovery jobs read the Entra, Azure, Power BI, Defender XDR and Intune role catalogs. New items are then handled according to your Discovery auto-create policy.
When enabled
From the next engine run and the next daily discovery jobs, new resources are found and logged. With the default policy ('flag') they are only reported. A type you set to 'pending' is staged for your review, and a type set to 'auto' is queued to be created as a normal change. The discovery decisions and baseline actions in PIM Manager can be used.
When disabled
The end-of-run sweep and the daily discovery jobs do nothing (each discovery job is recorded as skipped). Nothing is listed or auto-created, and PIM Manager refuses discovery decisions and baseline actions.
Risk and how to reverse it
Low with the default 'flag' policy, which only reads. If a resource type's policy is 'auto', new subscriptions or workspaces get definitions created without anyone reviewing them first. Reversible: switch it off and discovery stops on the next run. Definitions it already created stay until you remove them.
Requires
A Pro licence (without one the sweep is skipped, and switching it on is refused). SuperAdmin to change it. 'Scheduled jobs' must be on for the daily discovery jobs to run. The engine identity needs Reader on the Azure scopes you want discovered.
Recommended
Turn it on with the default 'flag' policy so you are told about new subscriptions and roles, and only set types to 'auto' once you trust the naming.
Related settings
- Scheduled jobs FeatureGates.scheduler.jobs
- Jobs FeatureFlags.jobs
- Direct-group types -- Tag prefix NamingConventions.GroupTypePrefixes
- Direct-group types -- Administrative unit NamingConventions.GroupTypeAdminUnits
- Permission-group administrative units NamingConventions.PermissionGroupAdminUnits
- PimGroupPattern (PIM group name) NamingConventions.PimGroupPattern
- PimGroupAuPattern (AU-scoped group name) NamingConventions.PimGroupAuPattern
- PimGroupTagRegex (strict tag check) NamingConventions.PimGroupTagRegex
- AdminUnitNamePattern (administrative unit name) NamingConventions.AdminUnitNamePattern
- Send a mail about newly discovered resources to DiscoveryNotifyRecipients
- Discovery: what happens with a newly discovered resource DiscoveryAutoCreate
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack