PIM Manager settings · Templates > Policy templates
Policy template used where a delegation names none -- Azure resource roles
| Key | PolicyTemplateDefaults.azureRole |
|---|---|
| Where | Templates > Policy templates |
| Type | Choice |
| Default | Built-in default (AzureRoles_Standard) |
| Feature | Policy templates you choose, changed only with approval · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The policy template that gives the PIM Manager recommendation for the PIM policy of each Azure role and scope pair your Azure delegations assign when the row leaves the policy template blank. If two rows name the same pair with different templates, the one requiring approval wins. It is a recommendation only: PIM Manager never changes a policy on its own.
When set
When set: the recommendation shown for these Azure roles on Templates > Policy settings follows the chosen template. A policy changes only for the settings where a SuperAdmin chose 'PIM Manager recommendation'. Every change set that comes from a choice is held, whatever its size, and nothing is written until it is approved. A SuperAdmin of the tenant approves the held change set in PIM Manager (Reviews & controls > Approvals); the approval is valid for 24 hours. The held change set says how many policies change and how many settings are weakened, and points out when more than 25 policies change or more than 3 settings are weakened (fixed numbers, not a setting: they never decide whether a change set is held).
When blank or default
At the built-in default: the recommendation for these pairs comes from AzureRoles_Standard (the same rules as the Entra role standard).
Risk and how to reverse it
An Azure role policy applies to everyone eligible for that role on that scope. Picking another template changes what 'PIM Manager recommendation' means for all of them; where that choice is made, the next policy run plans the change and holds it for a SuperAdmin's approval. PIM Manager never switches approval off on an Azure role policy. Reversible: pick the previous template.
Requires
SuperAdmin to change it. Free (Community) and Pro. The template must exist and be written for Azure resource roles. The engine's identity needs a role that may change role management policies on those scopes (for example User Access Administrator or Owner).
Recommended
Keep the built-in default, and name an approval-required template on rows that grant Owner or User Access Administrator. Then choose per setting on Templates > Policy settings.
Related settings
- Max activation duration OperationalPolicy.maxActivationDuration
- Max eligibility duration OperationalPolicy.maxEligibilityDuration
- Require MFA on activation OperationalPolicy.mfaOnActivation
- Policy template used where a delegation names none -- PIM for Groups PolicyTemplateDefaults.group
- Policy template used where a delegation names none -- Entra ID roles PolicyTemplateDefaults.directoryRole
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack