Activate my Azure resource roles in Privileged Identity Management

When you need to take on an Azure resource role, you can request activation by using the My roles navigation option in Privileged Identity Management.

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.

2. Browse to Identity governance > Privileged Identity Management > My roles.

   

3. Select Azure resource roles to see a list of your eligible Azure resource roles.

   

4. In the Azure resource roles list, find the role you want to activate.

   

5. Select Activate to open the Activate page.

   

6. If your role requires multifactor authentication, select Verify your identity before proceeding. You only have to authenticate once per session.

7. Select Verify my identity and follow the instructions to provide additional security verification.

   

8. If you want to specify a reduced scope, select Scope to open the Resource filter pane.

   It's a best practice to only request access to the resources you need. On the Resource filter pane, you can specify the resource groups or resources that you need access to.

   

9. If necessary, specify a custom activation start time. The member would be activated after the selected time.

10. In the Reason box, enter the reason for the activation request.

11. Select Activate.

    Note

    If the role requires approval to activate, a notification will appear in the upper right corner of your browser informing you the request is pending approval.

Privileged Identity Management supports Azure Resource Manager (ARM) API commands to manage Azure resource roles, as documented in the PIM ARM API reference. For the permissions required to use the PIM API, see Understand the Privileged Identity Management APIs.

To activate an eligible Azure role assignment and gain activated access, use the Role Assignment Schedule Requests - Create REST API to create a new request and specify the security principal, role definition, requestType = SelfActivate and scope. To call this API, you must have an eligible role assignment on the scope.

Use a GUID tool to generate a unique identifier that will be used for the role assignment identifier. The identifier has the format: 00000000-0000-0000-0000-000000000000.

Replace {roleAssignmentScheduleRequestName} in the below PUT request with the GUID identifier of the role assignment.

For more details on managing eligible roles for Azure resources, see this PIM ARM API tutorial.

The following is a sample HTTP request to activate an eligible assignment for an Azure role.

Request

PUT https://management.azure.com/providers/Microsoft.Subscription/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/providers/Microsoft.Authorization/roleAssignmentScheduleRequests/{roleAssignmentScheduleRequestName}?api-version=2020-10-01

Request body

{ 
"properties": { 
  "principalId": "aaaaaaaa-bbbb-cccc-1111-222222222222", 
  "roleDefinitionId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608", 
  "requestType": "SelfActivate", 
  "linkedRoleEligibilityScheduleId": "b1477448-2cc6-4ceb-93b4-54a202a89413", 
  "scheduleInfo": { 
      "startDateTime": "2020-09-09T21:35:27.91Z", 
      "expiration": { 
          "type": "AfterDuration", 
          "endDateTime": null, 
          "duration": "PT8H" 
      } 
  }, 
  "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'", 
  "conditionVersion": "1.0" 
} 
} 

Response

Status code: 201

You can view the status of your pending requests to activate.

1. Open Microsoft Entra Privileged Identity Management.

2. Select My requests to see a list of your Microsoft Entra role and Azure resource role requests.

   

3. Scroll to the right to view the Request Status column.

If you do not require activation of a role that requires approval, you can cancel a pending request at any time.

1. Open Microsoft Entra Privileged Identity Management.

2. Select My requests.

3. For the role that you want to cancel, select the Cancel link.

   When you select Cancel, the request will be canceled. To activate the role again, you will have to submit a new request for activation.
   

   

When a role assignment is activated, you'll see a Deactivate option in the PIM portal for the role assignment. Also, you can't deactivate a role assignment within five minutes after activation.

Activate with Azure portal

Privileged Identity Management role activation has been integrated into the Billing and Access Control (AD) extensions within the Azure portal. Shortcuts to Subscriptions (billing) and Access Control (AD) allow you to activate PIM roles directly from these blades.

From the Subscriptions blade, select “View eligible subscriptions” in the horizontal command menu to check your eligible, active, and expired assignments. From there, you can activate an eligible assignment in the same pane.

In Access control (IAM) for a resource, you can now select “View my access” to see your currently active and eligible role assignments and activate directly.

By integrating PIM capabilities into different Azure portal blades, this new feature allows you to gain temporary access to view or edit subscriptions and resources more easily.

Activate PIM roles using the Azure mobile app

PIM is now available in the Microsoft Entra ID and Azure resource roles mobile apps in both iOS and Android.

1. To activate an eligible Microsoft Entra role assignment, start by downloading the Azure mobile app (iOS | Android). You can also download the app by selecting Open in mobile from Privileged Identity Management > My roles > Microsoft Entra roles.

   

2. Open the Azure mobile app and sign in. Click on the ‘Privileged Identity Management’ card and select My Azure Resource roles to view your eligible and active role assignments.

   

3. Select the role assignment and click on Action > Activate under the role assignment details. Complete the steps to active and fill in any required details before clicking Activate at the bottom.

   

4. View the status of your activation requests and your role assignments under ‘My Azure Resource roles’.