Azure PIM for Groups

The Microsoft Entra SaaS connector now supports Privileged Identity Management (PIM) for Groups. This includes time-bound eligible and active group memberships managed through Microsoft Entra PIM.

  • Aggregation of PIM Group Assignment objects (azureADEligibleGroup and azureADActiveGroup) for Microsoft Entra ID during entitlement aggregation.

  • Aggregation of PIM Group Assignment objects (azureADEligibleGroups and azureADActiveGroups) for Microsoft Entra ID during Account aggregation.

  • Provisioning of Group Assignment on Users for Microsoft Entra ID PIM Group.

Prerequisites

  • Azure AD Premium P2 license.

  • Required to use Privileged Identity Management for Groups.

  • Enable Privileged Identity Management

    The Enable Privileged Identity Management checkbox must be selected in the connector's Azure Privileged Identity Management Settings section. For more information, refer to Manage Azure Privileged Identity Management.

  • Microsoft Graph API permissions

    The Enterprise Application used for the integration must have the permissions granted (Application type).

Microsoft Graph API permissions

Permission

Purpose

PrivilegedEligibilitySchedule.Read.AzureADGroup

Read PIM eligible group schedule instances

PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup

Assign/revoke eligible group memberships

PrivilegedAssignmentSchedule.Read.AzureADGroup

Read PIM active group schedule instances

PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup

Assign/revoke active group memberships

Important

  • Microsoft Graph returns a Request_UnsupportedQuery error (filter height 4, max 3) when you combine the PIM groups filter field value with the connector's internal group type filter. The internal filter always takes precedence. The user-defined filter applies independently.

  • The Graph API for eligibility and assignment schedule instances accepts principalId as a filter. The system fetches membership per account, not in bulk.