An Entra PIM access review that only lists who is activated right now misses the standing privilege. Privileged Identity Management separates eligible assignment from active assignment. Eligible means the person can activate the role. Active means the role is turned on for a window, often a few hours, with MFA and a ticket number. A Global Administrator eligibility with no end date is permanent power, even when the activation itself expires at the end of the day.
Auditors and attackers both care about eligibility. The compliance lead samples "who can become Global Admin." The directory shows four active assignments and forty permanent eligible ones. The spreadsheet from the last review tracked the four. Rutagon builds the review of eligibility, with permanent eligible roles as the population that must be decided, and files those decisions in the GRC you already run.
Eligible, active, and what "time-bound" modifies
An eligible assignment is a schedule. If the schedule's expiration type is noExpiration, or endDateTime is null, the principal can activate until someone removes the eligibility. A time-bound eligible assignment has an end. When that end passes, activation stops being possible. Those two shapes are different entitlements.
An activation is a second schedule on top of eligibility. PIM role settings can cap activation at a duration you choose, require a justification, and require MFA. That cap is good. It does not shrink the set of people who can start an activation tomorrow morning. Reviewing activations answers "who used the role this week." Reviewing eligibility answers "who is allowed to use it at all."
GET /roleManagement/directory/roleEligibilityScheduleInstances
GET /roleManagement/directory/roleAssignmentScheduleInstances
The first call is the population for this campaign. The second is context: who is active today, useful for an incident, and the wrong list to certify as complete. Microsoft documents eligibility instances in the roleEligibilityScheduleInstance resource. We filter to endDateTime null or expiration type noExpiration when the campaign question is "what standing eligibility exists."
Permanent eligible plus a short activation window still fails least privilege if the person no longer needs the role. The fix is to end the eligibility or to replace it with a dated eligibility that matches the project. Shortening only the activation duration leaves the standing grant.
Entra PIM access review of permanent eligible roles
Each row is a principal, a role definition, and the eligibility end. The reviewer is the role owner you named, not a generic manager who does not know why the eligibility exists. Permanent rows are marked so they cannot hide inside a list of expirations that already look healthy.
Approve on a permanent row means the business still wants that person to be able to activate, and a named owner accepts the standing grant. Where policy forbids standing admin, approve is not available. The only decisions are "replace with a dated eligibility" or "remove." We encode that in the campaign so a click cannot bless noExpiration against a written policy.
Revoke calls a PIM schedule request that removes the eligibility. We then re-read roleEligibilityScheduleInstances for that principal and role. Absence on the second read is the proof. Deactivating a current session without removing eligibility is an incident response step. It is not a completed access review. The person activates again after lunch.
Dated eligibility is the steady state we prefer for project admins. The end date is the decision. A row whose end is inside the next campaign window is renewed on purpose or allowed to lapse. Lapse is a successful outcome when the date was real.
Break-glass accounts are eligible or active by design and are few. They stay on a separate register with an owner, a stored factor, and a test cadence. They do not get bulk-approved with the engineering managers. The same discipline shows up on the AWS side in break-glass AWS access review. The IdP review and the cloud review are two extracts and one question: who can become admin without a change ticket.
What the first eligibility export shows
The first export shows former contractors still eligible for Privileged Role Administrator, nested groups assigned eligible where you expected users, and roles such as Exchange Administrator granted during a migration and never ended. Group eligibility means every member of the group can activate. We expand the group far enough to name users, using the same path idea as a nested group access review, and the reviewer decides the group grant with that membership visible.
Privileged directory roles are the core scope. Azure resource PIM and group PIM are additional schedules with the same permanent-versus-dated question. We do not boil the ocean in one campaign. We start with Entra directory roles that can change other people's access, because that is the sample that hurts. A second campaign can cover subscription PIM with the same record shape.
Activation history is attached as evidence of use, not as the entitlement. A principal with permanent eligibility and zero activations in the window is a strong revoke candidate. A principal with many activations still needs an owner to say the eligibility should continue. Usage proves the role is exercised. It does not prove it should be permanent.
Service principals eligible for directory roles are non-human privilege. They need an owner and a purpose, the same way a human does. An app registration that can activate Privileged Authentication Administrator is an application security decision, not a people-manager decision. We route those rows to the application owner.
Evidence and scope
For each decided row we file the principal, the role, whether the eligibility was permanent, the decision, the actor, and the second Graph read. The packet goes into the GRC you already run, against the access recertification control you already test. Entra access reviews can be configured to review eligible assignments. We still verify the campaign scope includes eligibility and not only active assignments. A completed review of the wrong population is a green check on the wrong question.
Identity Center permission sets on AWS are a sibling population for teams that split admin between Entra and AWS. IAM Identity Center access review covers that side. PIM eligibility is the Microsoft directory side. The diagnostic is useful when both exist and only one has been recertified.
Rutagon does not administer your Entra tenant as a managed service and does not claim your SOC 2 attestation. We build the extract, the permanent-eligibility filter, the removal request, and the evidence write. Your administrators keep the tenant. Your GRC keeps the decision.
Frequently Asked Questions
Why is a permanent eligible role still standing privilege if activation expires?
Activation is the temporary on-switch. Eligibility is the permission to throw that switch. When eligibility has no end date, the person can activate again whenever policy allows. Expiring yesterday's activation does not remove that ability.
Which Graph resource is the review population?
roleEligibilityScheduleInstances is the population. Permanent rows are those with no end or expiration type noExpiration. roleAssignmentScheduleInstances shows who is active now. Active assignments are context, not the full privileged population.
What does revoke mean in PIM?
Revoke removes the eligibility schedule and we re-read the eligibility instances to prove it. Ending an active session only, while eligibility remains, lets the principal activate again. The evidence is the missing eligibility, stored in the GRC you already run.
How do group-based eligible assignments work in the review?
The group can activate the role, so every member can. We expand membership far enough to name the users and show that list with the decision. Approving a group name with no members visible hides the effective admins.
Can Entra's own access review replace this extract?
It can host the workflow when the campaign is set to review eligible assignments. We check that setting. A review aimed at active assignments only will look complete and omit permanent eligibility. Decisions still file into the GRC you already run.
See what an Access & Credential Governance Diagnostic finds in your environment. Contact Rutagon at rutagon.com/contact, 907-841-8407, or contact@rutagon.com.