PIM Manager settings · Templates > Policy templates
Policy template used where a delegation names none -- Entra ID roles
| Key | PolicyTemplateDefaults.directoryRole |
|---|---|
| Where | Templates > Policy templates |
| Type | Choice |
| Default | Built-in default (EntraIDRoles_Standard) |
| Feature | Policy templates you choose, changed only with approval · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The policy template that gives the PIM Manager recommendation for the Entra ID role policy of every role your delegations assign (to groups, in administrative units, or directly) when the row leaves the policy template blank. If two rows name the same role with different templates, the one requiring approval wins. It is a recommendation only: PIM Manager never changes a policy on its own.
When set
When set: the recommendation shown for these roles on Templates > Policy settings follows the chosen template. A role's policy changes only for the settings where a SuperAdmin chose 'PIM Manager recommendation'. Every change set that comes from a choice is held, whatever its size, and nothing is written until it is approved. A SuperAdmin of the tenant approves the held change set in PIM Manager (Reviews & controls > Approvals); the approval is valid for 24 hours. The held change set says how many policies change and how many settings are weakened, and points out when more than 25 policies change or more than 3 settings are weakened (fixed numbers, not a setting: they never decide whether a change set is held).
When blank or default
At the built-in default: the recommendation for these roles comes from EntraIDRoles_Standard.
Risk and how to reverse it
A role policy applies to everyone who holds that role in the tenant, not only the groups PIM Manager manages. Picking another template changes what 'PIM Manager recommendation' means for all of them; where that choice is made, the next policy run plans the change and holds it for a SuperAdmin's approval. Reversible: pick the previous template.
Requires
SuperAdmin to change it. Free (Community) and Pro. The template must exist and be written for Entra ID roles. The engine needs RoleManagementPolicy.ReadWrite.Directory.
Recommended
Keep the built-in default, and name an approval-required template on the rows for your most privileged roles. Then choose per setting on Templates > Policy settings.
Related settings
- Max activation duration OperationalPolicy.maxActivationDuration
- Max eligibility duration OperationalPolicy.maxEligibilityDuration
- Require MFA on activation OperationalPolicy.mfaOnActivation
- Policy template used where a delegation names none -- PIM for Groups PolicyTemplateDefaults.group
- Policy template used where a delegation names none -- Azure resource roles PolicyTemplateDefaults.azureRole
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack