In PIM I have disallowed permanent active assignment for a group, but in AAD I can add the a permanent group member

Question

I've set a group in PIM to not allow permanent active assignment but when I add a user to the group in AAD, the user is assigned permanent active membership. This doesn't seem right.

I'm trying to configure the group so active membership can only be assigned for a certain time period (ideally 4 hours). Does anyone know a way of doing this?

Answer 1

With groups you can use this feature:

This will make them only eligible. I use this and works as expected:

https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups