PIM Manager settings · Templates > Policy templates
Policy template used where a delegation names none -- PIM for Groups
| Key | PolicyTemplateDefaults.group |
|---|---|
| Where | Templates > Policy templates |
| Type | Choice |
| Default | Built-in default (Groups_Standard) |
| Feature | Policy templates you choose, changed only with approval · Community, Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The policy template that gives the PIM Manager recommendation for the PIM for Groups policy of every group PIM Manager manages whose definition leaves the policy template blank. A template recommends how long an activation lasts, what is required to activate (for example multifactor authentication, a reason) and whether approval is needed. It is a recommendation only: PIM Manager never changes a policy on its own.
When set
When set: the recommendation shown for these groups on Templates > Policy settings follows the chosen template. A policy changes only for the settings where a SuperAdmin chose 'PIM Manager recommendation'. Every change set that comes from a choice is held, whatever its size, and nothing is written until it is approved. A SuperAdmin of the tenant approves the held change set in PIM Manager (Reviews & controls > Approvals); the approval is valid for 24 hours. The held change set says how many policies change and how many settings are weakened, and points out when more than 25 policies change or more than 3 settings are weakened (fixed numbers, not a setting: they never decide whether a change set is held).
When blank or default
At the built-in default: the recommendation for these groups comes from Groups_Standard.
Risk and how to reverse it
Picking another template changes what 'PIM Manager recommendation' means for many groups at once. Where that choice is made, the next policy run plans the change and holds it for a SuperAdmin's approval; settings on 'Keep current' or 'Microsoft default' are not affected. Reversible: pick the previous template.
Requires
SuperAdmin to change it. Free (Community) and Pro. The template must exist and be written for PIM for Groups. The engine needs RoleManagementPolicy.ReadWrite.AzureADGroup.
Recommended
Keep the built-in default unless your organisation has its own group standard; name a template on the definitions that need stricter rules. Then choose per setting on Templates > Policy settings.
Related settings
- Max activation duration OperationalPolicy.maxActivationDuration
- Max eligibility duration OperationalPolicy.maxEligibilityDuration
- Require MFA on activation OperationalPolicy.mfaOnActivation
- Policy template used where a delegation names none -- Entra ID roles PolicyTemplateDefaults.directoryRole
- Policy template used where a delegation names none -- Azure resource roles PolicyTemplateDefaults.azureRole
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack