Require approval to activate the Privileged Role Administrator role

Description

In Privileged Identity Management, the role settings of Privileged Role Administrator set Require approval to activate to Yes, with at least two approvers. Approvers are named administrators who are not the only eligible users of the role, so nobody approves their own activation.

PIM does not let users approve their own requests, but if the only approvers are also the only eligible users, two of them can approve each other: keep a separate approver.

Rationale

Privileged Role Administrator can assign any role, including Global Administrator, and change PIM settings. An attacker who activates it without approval can grant themselves every other privilege, so this role needs the same approval step as Global Administrator.

Impact

Activations wait for an approver: plan approvers in several time zones or on-call rotations, so that urgent work is not blocked. The emergency access accounts are permanently active and do not depend on approval. Approvers receive an email and approve in My Access or PIM.

Applies when

Requires: Microsoft Entra ID P2

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles > Privileged Role Administrator > Role settings.
3. Under Activation, check that Require approval to activate is Yes and that the approver list has at least two users or a group with at least two members.
4. Read-only alternative with Microsoft Graph (scope RoleManagementPolicy.Read.Directory): GET /policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq 'e8611ab8-c189-46e8-94e1-60213ab1f814'&$expand=policy($expand=rules), then read the rule Approval_EndUser_Assignment: setting.isApprovalRequired is true and approvalStages[0].primaryApprovers is not empty.
5. Fail if approval is not required or if fewer than two approvers are configured.

Remediation

1. With a Privileged Role Administrator, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles > Privileged Role Administrator > Role settings > Edit.
2. On the Activation tab, check Require approval to activate and select at least two approvers (users or a group).
3. Select Update. Tell eligible users and approvers about the new step.
4. Equivalent with Microsoft Graph: PATCH /policies/roleManagementPolicies/{policyId}/rules/Approval_EndUser_Assignment with isApprovalRequired: true and the approvers in approvalStages.

Rollback

Uncheck Require approval to activate in the role settings.

References

• Configure Microsoft Entra role settings in Privileged Identity Management Microsoft, vendor-doc, accessed 2026-10-24
• Approve or deny requests for Microsoft Entra roles in PIM Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management
• related CB-M365-ADMIN-007 Require approval to activate the Global Administrator role

People and lifecycle