An eligible assignment grants an identity the ability to activate a role only when privileged access is needed and the required activation action is completed. Unlike an active assignment, it does not keep the role’s permissions in effect permanently. This just-in-time pattern reduces standing administrative access while preserving the ability to perform necessary tasks. section 2.6.1
Configure an eligible assignment in Azure AD Privileged Identity Management (PIM):
- Open Azure AD Privileged Identity Management, choose Azure Resources, select the subscription, and open Roles. section 2.6.2
- Choose Add Assignments, select an Azure role such as Virtual Machine Administrator Login, and select a user or group. section 2.6.2
- Set Assignment Type to Eligible, specify assignment start and end times, and select Assign. section 2.6.2
- Configure role settings separately when needed, including activation requirements such as multifactor authentication or approval. section 2.6.2
Temporary virtual machine administration
Assign Bob, or a group containing Bob, an eligible Virtual Machine Administrator Login role for a defined interval. Bob can activate the role when a task requires it, subject to configured requirements such as MFA or approval. The Roles view then reports the number of eligible assignments alongside active assignments. section 2.6.2
PIM can apply eligible assignments to Azure RBAC roles, Azure AD roles, and privileged access groups. Assignments can target users or groups and can include start and end times, supporting time-bounded privilege management and auditing. section 2.6.1
