Created by Claude - please verify

PIM role settings - activation rules per privileged or assigned role (MFA, approval, justification, duration, permanent assignments).

Required Microsoft Graph permissions

RoleManagementPolicy.Read.Directory RoleManagement.Read.Directory — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P2 (Privileged Identity Management).

Endpoints: GET /v1.0/policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'&$expand=policy($expand=rules) · GET /beta/roleManagement/directory/roleDefinitions (isPrivileged)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

PIM Role Settings Audit

Just-in-time access is only as strong as its activation rules. A privileged role that can be activated without MFA, without approval, for a whole working day or permanently assigned is standing access with extra steps. Standing vs JIT Admin Access shows who holds roles; this report shows whether the PIM settings behind them are weak.