This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 35%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN7%3C/text%3E%3C/svg%3E)
I have a question on PIM (Privileged Identity Management). Let say, Users A, B, C, D, E have Reader role on subscription ABC right now. This is standing permanent access before enabling PIM. Now, we enable PIM, enable on this ABC subscription on this Reader role. What happens to these all 5 users' Reader roles? Will standing access be revoked or still we can see standing access? 2nd question: How can we automatically migrate standing Role to PIM role without manual efforts? In same scenario mentioned above, what I want is, User A,B,C,D,E should be converted to Eligible Role instead of Active Assignments, how can we achieve that? Because I have 13k+ subscriptions with 100K+ users. If I sit and do manual PIM rollout, this is not feasible. Any help appreciated.
An Azure service that is used to provision Windows and Linux virtual machines.
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
@Neel Darji
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
When you enable PIM, it will not affect any users with existing permanent access roles, this will stay as they are. If you wish to convert these from permanent to PIM roles you will need to go through the process to do so. If you don't want to do this manually, then you can use PowerShell and the PIM cmdlets to help do this for you, but there is no built-in automation to do so.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 41%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
Is my understating correct in that once you enable PIM on an Azure subscription, all of the pre existing RBAC assignments get brought into PIM as permanent, active assignments? You can then use the portal or PowerShell to modify these assignments to be eligible, expire, etc? I have a situation at work where there is a concern that pre existing RBAC assignments to subscriptions, management groups are orphaned from PIM due to them being assigned prior to PIM being onboarded to the environment.
I am almost certain this is the case but I am trying to find information to back this up..
Any pre-existing RBAC assignments will be permanent assignments in PIM.