Remove PIM tab for Check access, Fix Activate role steps

Author: rolyon

articles/role-based-access-control/check-access.md

@@ -6,7 +6,7 @@ author: rolyon
 manager: amycolannino
 ms.service: role-based-access-control
 ms.topic: quickstart
-ms.date: 12/09/2024
+ms.date: 12/12/2024
 ms.author: rolyon
 ms.custom: mode-other
 #Customer intent: As a new user, I want to quickly see access for myself, user, group, or application, to make sure they have the appropriate permissions.
@@ -73,10 +73,6 @@ If you have a Microsoft Entra ID P2 or Microsoft Entra ID Governance license, [M
 
 Follow these steps to check the access for a single user, group, service principal, or managed identity to the previously selected Azure resource.
 
-If you have a Microsoft Entra ID P2 or Microsoft Entra ID Governance license, [Microsoft Entra Privileged Identity Management (PIM)](/entra/id-governance/privileged-identity-management/pim-configure) functionality is integrated so you should follow the steps on the **PIM** tab.
-
-# [Default](#tab/default)
-
 1. Select **Access control (IAM)**.
 
 1. On the **Check access** tab, select the **Check access** button.
@@ -95,39 +91,10 @@ If you have a Microsoft Entra ID P2 or Microsoft Entra ID Governance license, [M
 
     - Role assignments added with Azure RBAC.
     - Deny assignments added using Azure Blueprints or Azure managed apps.
-    - Classic Service Administrator or Co-Administrator assignments for classic deployments. 
-
-    :::image type="content" source="./media/shared/rg-check-access-assignments-user.png" alt-text="Screenshot of role and deny assignments pane for a user." lightbox="./media/shared/rg-check-access-assignments-user.png":::
-
-# [PIM](#tab/pim)
-
-1. Select **Access control (IAM)**.
-
-1. On the **Check access** tab, select the **Check access** button.
-
-    A **Check access** pane appears.
-
-1. Select **User, group, or service principal**.
-
-1. In the search box, enter a string to search the directory for name or email addresses.
-
-    :::image type="content" source="./media/shared/rg-check-access-select.png" alt-text="Screenshot of Check access select list." lightbox="./media/shared/rg-check-access-select.png":::
-
-1. Select the user to open the **assignments** pane.
 
-    On this pane, you can see the access for the selected user at this scope and inherited to this scope. Assignments at child scopes aren't listed. You see the following assignments:
+    If there are any [eligible or time-bound role assignments](pim-integration.md), you can view these assignments on the **Eligible assignments** tab.
 
-    - Role assignments added with Azure RBAC.
-    - Deny assignments managed by Azure.
-    - Classic Service Administrator or Co-Administrator assignments for classic deployments.
-
-    :::image type="content" source="./media/check-access/rg-check-access-assignments-user-pim.png" alt-text="Screenshot of role assignments pane for a user for PIM integration." lightbox="./media/check-access/rg-check-access-assignments-user-pim.png":::
-
-    You also see a **Eligible assignments** tab with any eligible and time-bound role assignments. To start the activatation process, you can add a check mark next to a role you want to activate and then select **Activate role**. For more information, see [Eligible and time-bound role assignments](pim-integration.md) and [Activate eligible Azure role assignments](role-assignments-eligible-activate.md).
-
-    :::image type="content" source="./media/check-access/rg-check-access-assignments-user-pim-eligible.png" alt-text="Screenshot of role assignments pane and the Eligible assignments tab for a user for PIM integration." lightbox="./media/check-access/rg-check-access-assignments-user-pim-eligible.png":::
-
----
+    :::image type="content" source="./media/shared/rg-check-access-assignments-user.png" alt-text="Screenshot of role and deny assignments pane for a user." lightbox="./media/shared/rg-check-access-assignments-user.png":::
 
 ## Next steps
 

articles/role-based-access-control/media/check-access/rg-check-access-assignments-user-pim-eligible.png

@@ -5,7 +5,7 @@ author: rolyon
 manager: amycolannino
 ms.service: role-based-access-control
 ms.topic: how-to
-ms.date: 12/09/2024
+ms.date: 12/12/2024
 ms.author: rolyon
 ---
 
@@ -16,7 +16,7 @@ Eligible Azure role assignments provide just-in-time access to a role for a limi
 ## Prerequisites
 
 - Microsoft Entra ID P2 license or Microsoft Entra ID Governance license
-- [Eligible role assignment](./role-assignments-portal.yml#step-6-select-assignment-type)
+- [Eligible role assignment](pim-integration.md#pim-functionality)
 - `Microsoft.Authorization/roleAssignments/read` permission, such as [Reader](./built-in-roles/general.md#reader)
 
 ## Activate group membership (if needed)
@@ -31,19 +31,17 @@ These steps describe how to activate an eligible role assignment using the Azure
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
-1. Click **All services** and then select the scope. For example, you can select **Management groups**, **Subscriptions**, **Resource groups**, or a resource.
+1. Click **All services** and then select the scope. For example, you can select **Management groups**, **Subscriptions**, or **Resource groups**.
+
+    You can activate eligible role assignments at management group, subscription, and resource group scope, but not at resource scope.
 
 1. Click the specific resource.
 
 1. Click **Access control (IAM)**.
 
-1. In the **Action** column, click **Activate** for the role you want to activate.
-
-    The **assignments** pane appears and lists your eligible role assignments.
-
     :::image type="content" source="./media/role-assignments-eligible-activate/activate-role.png" alt-text="Screenshot of Access control page and Activate role assignments pane." lightbox="./media/role-assignments-eligible-activate/activate-role.png":::
 
-1. Add a check mark next to a role you want to activate and then click **Activate role**.
+1. In the **Action** column, click **Activate** for the role you want to activate.
 
     The **Activate** pane appears with activate settings.
 
@@ -65,7 +63,7 @@ These steps describe how to activate an eligible role assignment using the Azure
 
     When activation is complete, you see a message that the role was successfully activated.
 
-    Once an eligible role assignment has been activated, it will be listed as an active time-bound role assignment on the **Role assignments** tab. For more information, see [List Azure role assignments using the Azure portal](./role-assignments-list-portal.yml#list-role-assignments-at-a-scope).
+    Once an eligible role assignment has been activated, it will be listed as an active time-bound role assignment on the **Check access** and  **Role assignments** tabs. For more information, see [List Azure role assignments using the Azure portal](./role-assignments-list-portal.yml#list-role-assignments-at-a-scope).
 
 ## Next steps
 

articles/role-based-access-control/media/check-access/rg-check-access-assignments-user-pim.png

@@ -6,7 +6,7 @@ metadata:
   author: rolyon
   ms.author: rolyon
   manager: amycolannino
-  ms.date: 11/11/2024
+  ms.date: 12/12/2024
   ms.service: role-based-access-control
   ms.topic: how-to
   ms.custom:
@@ -154,7 +154,6 @@ procedureSection:
 
         - Role assignments added with Azure RBAC.
         - Deny assignments added using Azure Blueprints or Azure managed apps.
-        - Classic Service Administrator or Co-Administrator assignments for classic deployments. 
 
         ![Screenshot of assignments pane.](./media/shared/rg-check-access-assignments-user.png)