PIM Manager settings · Settings > Approvals & policy
Max activation duration
| Key | OperationalPolicy.maxActivationDuration |
|---|---|
| Where | Settings > Approvals & policy > Operational policy |
| Type | Choice |
| Default | 1 day (P1D) |
| Feature | Policy templates you choose, changed only with approval · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
The longest activation PIM Manager lets any policy template recommend, picked from 1 hour to 3 days. It caps the PIM Manager recommendation for the groups and roles PIM Manager manages: a template whose 'An activation lasts at most' is longer is recommended at this value instead. A template that is already shorter is left as it is. It is part of the recommendation only: PIM Manager never changes a policy on its own.
When set
When set lower than a template: the recommendation shown on Templates > Policy settings is shortened to this value. A policy is shortened in Entra only where a SuperAdmin chose 'PIM Manager recommendation' for 'Longest activation', and that change set is held until a SuperAdmin approves it (Reviews & controls > Approvals) -- whatever its size. The engine log names each template it shortened.
When blank or default
At the default (1 day): nothing changes -- Entra itself allows at most 24 hours for an activation, so the default never shortens a template.
Risk and how to reverse it
Medium when you lower it: where 'PIM Manager recommendation' is chosen and the change is approved, people who activate for longer than the new value have to activate again sooner. Activations already running are not cut short. Reversible: pick a longer value and save; the recommendation is the template's own value again.
Requires
SuperAdmin to change it. Free (Community) and Pro. Applies only to groups and roles PIM Manager manages.
Recommended
Leave it at 1 day and set the activation length per template; lower it to enforce a maximum across every template.
Related settings
- Max eligibility duration OperationalPolicy.maxEligibilityDuration
- Require MFA on activation OperationalPolicy.mfaOnActivation
- Policy template used where a delegation names none -- PIM for Groups PolicyTemplateDefaults.group
- Policy template used where a delegation names none -- Entra ID roles PolicyTemplateDefaults.directoryRole
- Policy template used where a delegation names none -- Azure resource roles PolicyTemplateDefaults.azureRole
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack