PIM assignments: eligible vs active, time-bound vs permanent
Verdict: Eligible means the user must activate before using the role; active means no action is needed. Time-bound has start and end dates; permanent has none. These are two independent axes, and just-in-time access is the eligible model.
| Criterion | Eligible assignment | Active assignment | Time-bound | Permanent |
|---|---|---|---|---|
| What it means | User must act (activate) to use the role | User already has the role's privileges | Valid only within start and end dates | No expiry, always in place |
| Axis | Whether action is needed | Whether action is needed | Duration | Duration |
| Use it for | No standing access, activate on demand (JIT) | Roles a user needs continuously | Fixed-length projects or contractors | Ongoing standing assignments |
Rules
- An eligible assignment requires the user to perform an action such as activation before using the role; an active assignment requires no action.
- A time-bound assignment is valid only within configured start and end dates; a permanent assignment has none - duration is separate from eligible versus active.
- Just-in-time access grants temporary permissions only when needed, so they cannot be misused after they expire.
- PIM can prevent removal of the last active Global Administrator and Privileged Role Administrator, so the tenant is never left without them.
Traps
- Eligible versus active is about whether action is required, not duration - an eligible assignment can itself be permanent or time-bound.
- An active assignment does not require activation; it is the opposite of needing to act first, not a synonym for permanent.