Skip to content

Commit b7ae3bf

Browse files
Merge pull request #229415 from amsliu/pim-update-2
minor update
2 parents 9ac5ef6 + d15579c commit b7ae3bf

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/active-directory/privileged-identity-management/concept-pim-for-groups.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ ms.subservice: pim
1111
ms.topic: overview
1212
ms.tgt_pltfrm: na
1313
ms.workload: identity
14-
ms.date: 01/25/2023
14+
ms.date: 3/3/2023
1515
ms.author: amsliu
1616
ms.custom: pim
1717
ms.collection: M365-identity-device-management
@@ -52,7 +52,7 @@ Azure AD role-assignable group feature is not part of Azure AD Privileged Identi
5252

5353
Groups can be role-assignable or non-role-assignable. The group can be enabled in PIM for Groups or not enabled in PIM for Groups. These are independent properties of the group. Any Azure AD security group and any Microsoft 365 group (except dynamic groups and groups synchronized from on-premises environment) can be enabled in PIM for Groups. The group does not have to be role-assignable group to be enabled in PIM for Groups.
5454

55-
If you want to assign Azure AD role to a group, it has to be role-assignable. Even if you do not intend to assign Azure AD role to the group but the group provides access to sensitive resources, it is still recommended to consider creating the group as role-assignable. This is because of extra protections role-assignable groups have – see “What are Azure AD role-assignable groups?” in the section above.
55+
If you want to assign Azure AD role to a group, it has to be role-assignable. Even if you do not intend to assign Azure AD role to the group but the group provides access to sensitive resources, it is still recommended to consider creating the group as role-assignable. This is because of extra protections role-assignable groups have – see [“What are Azure AD role-assignable groups?”](#what-are-azure-ad-role-assignable-groups) in the section above.
5656

5757
Up until January 2023, it was required that every Privileged Access Group (former name for this PIM for Groups feature) had to be role-assignable group. This restriction is currently removed. Because of that, it is now possible to enable more than 500 groups per tenant in PIM, but only up to 500 groups can be role-assignable.
5858

0 commit comments

Comments
 (0)