PIM Manager settings · Operations > Guards
Limit: bulk revoke
| Key | GuardLimits.BulkRevoke |
|---|---|
| Where | Operations > Guards |
| Type | Number |
| Default | 5 assignments in one batch |
| Feature | PIM policy changes wait for a SuperAdmin · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
How many assignments one bulk revoke may take away before it needs more than a click. A batch larger than this must be confirmed by typing its exact count, and it needs an approved request on the Approvals page. Both checks use this one number.
When set
When set: a revoke of up to this many assignments goes ahead after the usual confirmation. A larger batch is confirmed with its count and approved by a person with permission over the assignments (their scope and level) or a SuperAdmin -- never by the person who asked.
When blank or default
At the default: 5 assignments in one batch. The check itself cannot be switched off.
Risk and how to reverse it
A higher number lets one person revoke more access in one batch without a second person. The number can only be set from 1 to 25; a stored value outside that range is ignored and 5 applies. Reversible at any time.
Requires
SuperAdmin to change it, on Operations > Guards. Free (Community) and Pro.
Recommended
Keep 5. For a planned larger revoke, have it approved once instead of raising the limit.
Related settings
- Second person for a release GuardReleaseSecondPerson
- Limit: commit removal check GuardLimits.CommitRemoval
- Limit: removal budget GuardLimits.RemoveBudget
- Limit: account-disable circuit breaker GuardLimits.DisableBreaker
- Limit: admin account deletes per run GuardLimits.AdminDelete
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack