Forum Discussion

Qonnect's avatar
Qonnect
Tin Contributor
Jul 07, 2025

Adding PIM enabled security group to an Access Package

Hi,

Recently a new feature has gone in preview, it's now possible to add PIM enabled security group to an access package.

explained here: 

https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-eligible

I followed the instruction exactly on 2 different tenants, one tenant has Entra ID Governance licence, another has the Entra Suite licence. 
The result on both tenants was the same. 

When adding a PIM enabled group to an access package.
I am presented only with 2 roles (member or owner) and not with the expected 4 roles. (member, owner, eligible member, eligible owner).
The group I add is created for test purpose couple of weeks ago, and really is PIM enabled (discovered ).

Is this a preview that has to be activated on a tenant?
(its not in the "Entra -> Identity -> settings -> Preview features" list).

Am i missing something?

Cheers!

2 Replies

  • GoXATAKAN's avatar
    GoXATAKAN
    Brass Contributor
    Jul 26, 2026

    Hi,

    A couple of things worth checking here.

    First, confirm the group's membership type is Assigned, not Dynamic. Dynamic membership groups only ever expose the Owner role in an access package by design and this holds true even if the group is otherwise PIM enabled. If the test group was created with dynamic membership, that alone explains only seeing 2 roles instead of 4.

    Second, being "PIM enabled" for a group is not the same as being fully onboarded to PIM for Groups. The docs describe a specific flow: go to ID Governance > Privileged Identity Management > Groups > Discover groups, select the group, then Manage groups > OK. Only after that step does the group show up in the PIM for Groups managed list and only then does entitlement management expose Member / Owner / Eligible Member / Eligible Owner when you add it as a resource role. If the group was enabled for PIM through a different path (for example directly in the group's own PIM blade rather than through Discover groups), it may not be registered the same way entitlement management expects.

    Third, make sure the account adding the resource role has at least Identity Governance Administrator, Catalog owner, or Access package manager permissions on that catalog. Insufficient permissions here usually show as "no available items" rather than 2 vs 4 roles, but worth ruling out.

    On licensing: this is not a tenant preview feature you toggle under Identity > Settings > Preview features. It is a licensing gated capability (Entra ID Governance or Entra Suite), so since both your tenants already have one of those, that is not the blocker.

    I would recheck the group's membership type first, then confirm it actually appears in the PIM for Groups managed list before touching the access package. That is the most common cause of this exact symptom.

  • IdentitySecurist's avatar
    IdentitySecurist
    Copper Contributor
    Jul 22, 2026

    This isn't controlled by a tenant-level preview setting. If your group is already PIM-enabled and you've met the documented prerequisites, the additional Eligible member and Eligible owner options should appear automatically.

    If you're only seeing Member and Owner, it's most likely because the feature hasn't been enabled for your tenant yet. Since it's a preview feature, Microsoft is rolling it out gradually, and not all tenants receive preview capabilities at the same time, even if they have the required licenses.

    There isn't a manual switch under Entra > Identity > Settings > Preview features to enable this functionality. At this point, the only thing you can do is wait for the rollout to reach your tenant or open a Microsoft support case to verify whether the preview has been enabled for your tenant.

    If this resolves your issue, please consider marking the answer as the solution so it can help others facing the same problem.