# Azure PIM Provisioning Policy

**URL:** <https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116>\
**Category:** Connectivity Documentation Feedback\
**Tags:** microsoft-con-docs, va-con-docs\
**Created:** [June 4, 2024, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116 "2024-06-04T14:57:27Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![DocsTeam](https://avatars.discourse-cdn.com/v4/letter/d/ecd19e/32.png) [@DocsTeam](https://developer.sailpoint.com/discuss/u/DocsTeam)\
**Post date:** [June 4, 2024, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/1 "2024-06-04T14:57:27Z")

</div>

There is no requirement of addition/removal of the existing Create Profile (Provisioning Policy). However, while assigning/removing Azure /Microsoft Entra ID Eligible/Active Role assignment, additional request details can be provided through additional attributes such as the following:

* * *
This is the companion discussion topic for the documentation at [https://documentation.sailpoint.com/connectors/microsoft/entra\_id/help/integrating\_entra\_id/azure\_pim\_provisioning\_policy.html](https://documentation.sailpoint.com/connectors/microsoft/entra_id/help/integrating_entra_id/azure_pim_provisioning_policy.html)

---

<div class="post-metadata">

**Author:** ![adamslamena](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/adamslamena/32/13745_2.png) [@adamslamena](https://developer.sailpoint.com/discuss/u/adamslamena)\
**Post date:** [February 13, 2025, 8:16am UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/2 "2025-02-13T08:16:55Z")

</div>

Dear Developers,

From this documentation I do not understand where to set the attributes like the duration for example and where to pass them.

Please could you review the documentation and be more descriptive on what policy to use and how an example of hte policy could look like, rather than the output ?

Thank you !

---

<div class="post-metadata">

**Author:** ![Nileema](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/nileema/32/14446_2.png) [@Nileema](https://developer.sailpoint.com/discuss/u/Nileema)\
**Post date:** [February 24, 2025, 5:36am UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/5 "2025-02-24T05:36:55Z")

</div>

Hi Adam! Thank you for your input. We’ve created a Jira issue to track the effort, and we’ll update the comment thread when it’s been addressed: CONDOCS-5827

Thanks.

---

<div class="post-metadata">

**Author:** ![jewalker](https://avatars.discourse-cdn.com/v4/letter/j/85e7bf/32.png) [@jewalker](https://developer.sailpoint.com/discuss/u/jewalker)\
**Post date:** [June 10, 2025, 8:14pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/6 "2025-06-10T20:14:55Z")

</div>

I’m in the same boat here. It is not clear where I need to update the source to enable adding these helpful values to Entra PIM assignments.

---

<div class="post-metadata">

**Author:** ![adamslamena](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/adamslamena/32/13745_2.png) [@adamslamena](https://developer.sailpoint.com/discuss/u/adamslamena)\
**Post date:** [June 23, 2025, 8:37am UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/7 "2025-06-23T08:37:57Z")

</div>

It is a beforeprovisioning rule to be attached to the source.  
Below you can find a code snippet, just make sure to include all your other rules you might have for different attributes or account creation,disabling etc. So don’t take this as gospel 😃 :

```auto
<![CDATA[
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.object.Attributes;
import java.util.HashMap;
import java.util.Map;

// Log rule execution
log.info("Executing Before Provisioning Rule for all applications");

    // Iterate over all account requests in the provisioning plan
    for (AccountRequest accountRequest : plan.getAccountRequests()) {

      // Iterate over all AttributeRequests
      for (AttributeRequest attributeRequest : accountRequest.getAttributeRequests()) {

          // Target azureADActiveRoles and azureADEligibleRoles AttributeRequests
          if ("azureADActiveRoles".equals(attributeRequest.getName()) ||
              "azureADEligibleRoles".equals(attributeRequest.getName())) {

            // Create MAP duuuuuh
            Map argsMap = new HashMap();
            argsMap.put("duration", "permanent");

            // Wrap the MAP inside Attributes object
            Attributes attributes = new Attributes();
            attributes.putAll(argsMap);

            // Set arguments in the attribute request
            attributeRequest.setArguments(attributes);

            // Log for testing
            log.info("Successfully set duration to: permanent");
          }
      }
    }
  ]]>

```

---

<div class="post-metadata">

**Author:** ![gscalia](https://avatars.discourse-cdn.com/v4/letter/g/fbc32d/32.png) [@gscalia](https://developer.sailpoint.com/discuss/u/gscalia)\
**Post date:** [September 15, 2025, 8:13pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/8 "2025-09-15T20:13:27Z")

</div>

Hello Adam, what type of BeforeProvisioning rule are you referring to?  
From your snippet it looks more like a Web Services rule rather than an Azure/Entra ID rule with PowerShell scripting. Where exactly are you attaching this?  
I’m currently working on something similar but in a _Before Modify Azure/AD_ rule. Am I missing something here?

---

<div class="post-metadata">

**Author:** ![gscalia](https://avatars.discourse-cdn.com/v4/letter/g/fbc32d/32.png) [@gscalia](https://developer.sailpoint.com/discuss/u/gscalia)\
**Post date:** [September 16, 2025, 7:48pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/9 "2025-09-16T19:48:49Z")

</div>

Adam, I just realized this is a Cloud BeforeProvisioning Rule. Sorry for the confusion 😅

---

<div class="post-metadata">

**Author:** ![adamslamena](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/adamslamena/32/13745_2.png) [@adamslamena](https://developer.sailpoint.com/discuss/u/adamslamena)\
**Post date:** [September 17, 2025, 8:23am UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/10 "2025-09-17T08:23:22Z")

</div>

haha no worries We had some issues with a null pointer (when the request was for anything else than azureADActiveRoles or azureADEligibleRoles), so we added this line to the cloud rule - just FYI so you don’t run into the same 😃

```auto
  // Safely grab the list of AttributeRequests (skip if null)
  List<AttributeRequest> attributeRequests = accountRequest.getAttributeRequests();
  if (attributeRequests == null) {
    continue;
  }

```

---

<div class="post-metadata">

**Author:** ![Sushantmr](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@Sushantmr](https://developer.sailpoint.com/discuss/u/Sushantmr)\
**Post date:** [October 23, 2025, 10:33pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/11 "2025-10-23T22:33:09Z")

</div>

@adamslamena Do know if this can be achieved using the Services Standard Before Provisioning Rule? I configured the event below to add both the duration and the givenName. While I see that the givenName was successfully updated, the eligible role is still being added with a one-year end date.

> {  
> “eventConfigurations”: [  
> {  
> “eventActions”: [  
> {  
> “Action”: “AddArgument”,  
> “Attribute”: “duration”,  
> “Value”: “P7D”  
> },  
> {  
> “Action”: “UpdateAttribute”,  
> “Attribute”: “givenName”,  
> “Value”: “#{identity.firstname}”  
> }  
> ],  
> “Entitlement Update Triggers”: [  
> {  
> “Attribute”: “azureADEligibleRoles”,  
> “Value”: “\*”,  
> “Operation”: “Add”  
> }  
> ],  
> “Operation”: “Modify”  
> }  
> ]  
> }

---

<div class="post-metadata">

**Author:** ![adamslamena](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/adamslamena/32/13745_2.png) [@adamslamena](https://developer.sailpoint.com/discuss/u/adamslamena)\
**Post date:** [October 28, 2025, 12:27pm UTC](https://developer.sailpoint.com/discuss/t/azure-pim-provisioning-policy/62116/12 "2025-10-28T12:27:45Z")

</div>

Hello Sushant,

It is a beforeProvisioning rule on the cloud connector.  
You can find the snippet above in one of my comments above of the rule we constructed.  
You have to iterate over attributerequests and then insert a map including the attributes.