PIM Manager settings · Operations > Guards
Limit: account-disable circuit breaker
| Key | GuardLimits.DisableBreaker |
|---|---|
| Where | Operations > Guards |
| Type | Number |
| Default | 3 accounts per run |
| Feature | PIM policy changes wait for a SuperAdmin · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
How many admin accounts one engine run may disable. It is a count of accounts: the share of the scanned accounts plays no part. When a run would disable more, it disables none of them and holds the list. The number bounds three things: accounts disabled because their row says so (the account status, a passed disable date), accounts disabled by an offboarding in one run, and accounts disabled by the inactivity sweep where it is set to enforce.
When set
When set: up to this many accounts are disabled by a run when their rows say so. More than this is held until a SuperAdmin releases exactly that list of accounts on Operations > Guards, for one run. Break-glass accounts are never disabled, whatever this number is.
When blank or default
At the default: 3 accounts per run. The breaker itself cannot be switched off.
Risk and how to reverse it
A higher number lets one run lock more administrators out before anyone has looked at the list. The number can only be set from 1 to 25; a stored value outside that range is ignored and 3 applies. Reversible at any time.
Requires
SuperAdmin to change it, on Operations > Guards. Free (Community) and Pro.
Recommended
Keep 3: a real offboarding is a few accounts. For a larger one, release that exact list once instead of raising the limit.
Related settings
- Second person for a release GuardReleaseSecondPerson
- Limit: commit removal check GuardLimits.CommitRemoval
- Limit: removal budget GuardLimits.RemoveBudget
- Limit: bulk revoke GuardLimits.BulkRevoke
- Limit: admin account deletes per run GuardLimits.AdminDelete
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack