EntraID PIM Roles Management

[Sushantmr (Sushant Maharjan)]

Hello,

I’m working on provisioning Entra ID PIM eligible roles through SailPoint Identity Security Cloud. I’ve successfully configured the process to add and remove users from PIM eligible roles. However, I’m encountering an issue where SailPoint assigns an end time of one year when adding users to these roles. My goal is to make these assignments permanent, not time-bound.

Based on the documentation ( Azure PIM Provisioning Policy ), it seems that setting the duration attribute to “permanent” should achieve this. Unfortunately, the documentation doesn’t provide guidance on how to properly configure this attribute. I attempted to use the Services Standard Before Provisioning Rule to set the duration, but it didn’t work as expected. While I can confirm that attributes like givenName are being updated, the eligible role assignment still defaults to a one-year duration.

{
   "eventConfigurations":[
      {
         "eventActions":[
            {
               "Action":"AddArgument",
               "Attribute":"duration",
               "Value":"permanent"
            },
            {
               "Action":"UpdateAttribute",
               "Attribute":"givenName",
               "Value":"#{identity.firstname}"
            }
         ],
         "Entitlement Update Triggers":[
            {
               "Attribute":"azureADEligibleRoles",
               "Value":"*",
               "Operation":"Add"
            }
         ],
         "Operation":"Modify"
      }
   ]
}

Has anyone successfully used SSBPR to make PIM eligible role assignments permanent? If so, could you share how you configured the duration attribute or any other approach that worked for you?

Thanks.

[Muhammadawais12 (Muhammad Awais)]

Hi Sushant! I have done this in SailPoint IIQ using BeforeProvisioning Rule. Below is the rule that should work. Please update it accordingly for ISC.

// Iterate through each account request in the provisioning plan
for ( AccountRequest accountRequest : plan.getAccountRequests() ) {
  // Go through each attribute request in the account request
  if (plan.getAccountRequests() != null) {
    
  for (AttributeRequest attrReq : accountRequest.getAttributeRequests()) {
    String name = attrReq.getName();
    String operation = attrReq.getOperation().toString();
    
    // Check if attribute name is azureADEligibleRoles and operation is Add
    if ("azureADEligibleRoles".equals(name) && "Add".equals(operation)) {
      
      String duration = "permanent";
      String justification = "testing duration";

      Map attrs = new HashMap();
      attrs.put("duration", duration);
      attrs.put("justification", justification);
      
      Attributes attributes = new Attributes();
      attributes.putAll(attrs);

      attrReq.setArguments(attributes);
    }
  }

      }
    } else {
      log.debug("No account requests found in the provisioning plan.");
    }