PIM Manager settings · Settings > Approvals & policy

Daily reconcile: removal of leftovers

Key	ReconcileRemovalMode
Where	Settings > Approvals & policy > Daily reconcile: removal of leftovers
Type	Choice
Default	Not set: leftovers are removed

What it does

Decides what the daily full run (the job full-reconcile) does with a leftover: a live assignment or membership that PIM Manager put in your tenant, whose definition was later removed by a PIM Manager commit, and for which nothing similar is configured. The card shows the mode in effect, where it comes from and what the last daily run counted. PIM Manager asks for confirmation before the mode is changed.

When set

When set to 'Remove leftovers': the daily run removes the leftovers that qualify. It never disables or deletes an admin account, never removes a shared Defender XDR or Intune assignment, and never removes anything that existed before PIM Manager recorded its changes.

When blank or default

When set to 'Report only': the daily run removes none of them and lists on Jobs what it would remove. Not set at all means 'Remove leftovers'.

Risk and how to reverse it

Remove leftovers: a removal cannot be undone from this page; the removal guard still applies and cannot be switched off here, and when more items qualify than the guard allows in one run, none is removed in that run. Report only: access whose definition was removed stays live in your tenant until somebody removes it by hand.

Requires

SuperAdmin to change it, with a confirmation. While nothing is set here, a value in the engine job's own environment decides; the card says so where PIM Manager can read it.