EntraID provide removeDate based on Access Request for AzureActiveRoles | PIM

[kozonek (Nils Kozonek)]

Dear Developer Community,

we are currently trying to provide a dynamic removeDate or duration (based on the Access Request input) for AzureActiveRoles Provisioning.

Based on this documentation, Azure expects either a duration or a startDateTime and endDateTime and a justification to work properly for locked AzureActiveRoles:

Azure PIM Provisioning Policy

To provide a static endDateTime or duration is achievable through a cloud rule:

EntraID PIM Roles Management

Hello, I’m working on provisioning Entra ID PIM eligible roles through SailPoint Identity Security Cloud. I’ve successfully configured the process to add and remove users from PIM eligible roles. However, I’m encountering an issue where SailPoint assigns an end time of one year when adding users to these roles. My goal is to make these assignments permanent, not time-bound. Based on the documentation ( Azure PIM Provisioning Policy ), it seems that setting the duration attribute to “permanent”…

But how can we provide those attributes dynamically from the Access Request?

We´ve tried to set the enDateTime via a Standard Cloud rule but weren´t lucky.

Thanks and best in advance
Nils

[PhilRawlings1 (Phil Rawlings)]

What do you mean by ‘dynamically’?
Surely if you want a variable date, just have the duration field on the form and pass that value over

[kozonek (Nils Kozonek)]

Hi Phil,

thanks for the response!

By dynamically I mean pulling the removeDate within the before Provisioning Cloud Rule from the Access Request to provide it in the provisioning Plan.

If thats possible, how can I pull it?