PIM Manager settings · Operations > Guards
Limit: removal budget
| Key | GuardLimits.RemoveBudget |
|---|---|
| Where | Operations > Guards |
| Type | Number |
| Default | 5 removals per scope per run |
| Feature | PIM policy changes wait for a SuperAdmin · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
How many removals one engine run may apply in one scope without an approval. When a run would remove more, it removes none of them in that scope and holds the list. This ONE number bounds seven things: removals a row asks for (Action = Remove), per kind of assignment; the clean-up of leftovers PIM Manager manages (a full run with prune); removals by the daily reconcile, where it is set to enforce; groups deleted because their definition is marked Retire; groups deleted from the change queue (a DELETE chosen on the Drift page); admin accounts offboarded in one run; and, in a managed tenant, central admins the managing tenant withdraws in one pull. Raising it raises all seven.
When set
When set: up to this many removals per scope are applied by a run without asking. More than this needs a SuperAdmin's approval of the exact list: in the commit popup when the removals are committed (the run then applies exactly those items, whatever their number), or on Operations > Guards for a list a run already holds. Anything that is not in the approved list is still held.
When blank or default
At the default: 5 removals per scope per run. The guard itself cannot be switched off.
Risk and how to reverse it
A higher number lets one run remove more access without anyone approving the list: a wrong bulk edit or a bad read does more damage before it is noticed. The number can only be set from 1 to 25; a stored value outside that range is ignored and 5 applies. Reversible at any time.
Requires
SuperAdmin to change it, on Operations > Guards. Free (Community) and Pro.
Recommended
Keep 5. For a planned clean-up, let a SuperAdmin approve that list when it is committed instead of raising the limit for every run.
Related settings
- Second person for a release GuardReleaseSecondPerson
- Limit: commit removal check GuardLimits.CommitRemoval
- Limit: account-disable circuit breaker GuardLimits.DisableBreaker
- Limit: bulk revoke GuardLimits.BulkRevoke
- Limit: admin account deletes per run GuardLimits.AdminDelete
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack