PIM eligible vs active vs permanent, and where scope and activation controls live
Verdict: Use an eligible assignment for privileges held only when activated. Narrow reach with assignment scope, not duration. Justification and MFA are activation role settings. Conditional Access gates sign-in, never whether a role is standing.
| Criterion | Eligible assignment | Active assignment | Permanent active | Entra custom role | Conditional Access |
|---|---|---|---|---|---|
| What it grants | Privileges only after a time-bound activation | Standing access for the whole duration | Continuous access, no activation step | A tailored directory permission set | Sign-in conditions, not permissions |
| Fits | Month-end or incident roles that must not sit dormant | A defined active window with no per-use step | Never for least privilege | Password reset plus license management with no matching built-in role | MFA or device compliance at sign-in |
| Narrowed by | Activation window and approval | Duration | Nothing | Only the permissions selected | Targeted app or user |
Rules
- Choose an eligible assignment with a time-bound activation window so privileged access exists only when actively requested and approved.
- Require justification text and Azure MFA on every activation through PIM role settings, independent of any earlier sign-in.
- Restrict a role to one resource group in the PIM assignment scope, not in the duration or a Conditional Access policy.
- Build a Microsoft Entra custom role when no built-in role matches a narrow permission set such as password reset plus licensing.
Traps
- Conditional Access controls sign-in conditions; it cannot make a role activation-based or narrow which resources a role covers.
- Activation maximum duration limits session length, not the resource boundary a role applies to - that is assignment scope.
- An Entra custom role is not an Azure RBAC custom role; Azure RBAC governs resources, not directory operations like password reset.