Question

You are the Identity Administrator for Contoso. Leadership wants you to proactively reduce standing privileged access risk in Microsoft Entra Privileged Identity Management (PIM). During a review of the PIM 'Alerts' dashboard for Entra roles, you notice an alert titled 'Roles are being assigned outside of Privileged Identity Management.' You want to remediate the underlying issue so that all privileged role assignments are governed by PIM going forward. Which action addresses the root cause of this alert?

Accepted Answer

Identify the assignments made directly through Microsoft Entra roles (not via PIM) and re-create them as eligible assignments within PIM.

Answer

Lower the maximum activation duration in the PIM role settings for the affected roles.

Answer

Configure an access review on the affected roles so reviewers periodically confirm the assignments.

Answer

Add the affected users to a role-assignable group and assign the group the role directly.