Bring groups into Privileged Identity Management

In Microsoft Entra ID, you can use Privileged Identity Management (PIM) to manage just-in-time membership in the group or just-in-time ownership of the group. Groups can be used to provide access to Microsoft Entra roles, Azure roles, and various other scenarios. To manage a Microsoft Entra group in PIM, you must bring it under management in PIM.

Identify groups to manage

Before starting, you need a Microsoft Entra Security group or Microsoft 365 group. To learn more about group management in Microsoft Entra ID, see Manage Microsoft Entra groups and group membership.

Dynamic groups and groups synchronized from on-premises environment cannot be managed in PIM for Groups.

You need appropriate permissions to bring groups in Microsoft Entra PIM. For role-assignable groups, you need to have at least the Privileged Role Administrator role or be an Owner of the group. For non-role-assignable groups, you need to have at least the Directory Writer, Groups Administrator, Identity Governance Administrator, User Administrator role, or be an Owner of the group. Role assignments for administrators should be scoped at directory level (not administrative unit level).

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.

2. Browse to Identity governance > Privileged Identity Management > Groups.

3. Here you can view groups that are already enabled for PIM for Groups.

   

4. Select Discover groups and select a group that you want to bring under management with PIM.

   

5. Select Manage groups and OK.

6. Select Groups to return to the list of groups enabled in PIM for Groups.

Or, you can use the Groups pane to bring group under Privileged Identity Management.

Next steps

• Assign eligibility for a group in Privileged Identity Management
• Activate your group membership or ownership in Privileged Identity Management
• Approve activation requests for group members and owners