PIM Manager settings · Settings > Approvals & policy
Require MFA on activation
| Key | OperationalPolicy.mfaOnActivation |
|---|---|
| Where | Settings > Approvals & policy > Operational policy |
| Type | On / off |
| Default | On |
| Feature | Policy templates you choose, changed only with approval · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
A floor on every activation policy the engine writes for the groups and roles PIM Manager manages. When it is on, the engine adds MFA to the 'To activate, require' checks of any policy template that sets those checks without MFA (a template that asks for a Conditional Access authentication context counts as covered). It never removes a check a template asks for.
When enabled
When on: on the next engine run every managed group and role whose template sets activation checks without MFA requires MFA when someone activates, through the normal policy apply and its safety checks. A template that sets no activation checks at all is reported in the engine log and left to Entra.
When disabled
When off: the engine applies the activation checks exactly as each policy template says -- a template without MFA then activates without MFA. Turning it off does not by itself remove MFA anywhere: the shipped templates all require MFA.
Risk and how to reverse it
Low when on (people must complete MFA when they activate). Turning it off removes the safety net for a template that forgets MFA. Reversible at any time; the next engine run applies the new value.
Requires
SuperAdmin to change it. Free (Community) and Pro. Applies only to groups and roles PIM Manager manages.
Recommended
Keep it on.
Related settings
- Max activation duration OperationalPolicy.maxActivationDuration
- Max eligibility duration OperationalPolicy.maxEligibilityDuration
- Policy template used where a delegation names none -- PIM for Groups PolicyTemplateDefaults.group
- Policy template used where a delegation names none -- Entra ID roles PolicyTemplateDefaults.directoryRole
- Policy template used where a delegation names none -- Azure resource roles PolicyTemplateDefaults.azureRole
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack