Activating Multiple AD roles together with PIM

The link offered by P4tr8k on Nov 07, 2022 doesn't work (I suspect because the content of the target web page has changed to longer included the targeted text), but we've been able to achieve the desired results that Skywalker0077 asked for, something like so.

1. Create a group in Entra ID with Microsoft Entra roles can be assigned to the group set to Yes
2. With the group selected, click on Assigned Roles then add the Roles required as Active Assignments (not Eligible Assignments...unless you want to defeat the whole purpose of this exercise!)
3. With the group selected, click on Privileged Identity Management (under Activity) to add in the staff you want to apply this to as Eligible Assignments.

Now, when each member of your Support staff wants to enable their roles in one go they should

1. Log in to Entra
2. Go to Privileged Identity Management
3. Click on My roles.
4. Click on Groups (rather than Microsoft Entra roles, as they would have before)
5. Click on the Activate link...
6. ...and complete the Reason field (don't laugh!)

This activates their membership of the group, which grants them the Active Roles assigned to that Group.

---

Whether this is a good idea or not is another question!

I think as long as it's used thoughtfully for only a few, relatively 'harmless' roles, I guess it's okay. It definitely shouldn't be used for high privilege roles like Global Administrator, nor to grant a high number of roles.

In other words, if it's to ease workflow for frequently used roles and prevent 'security fatigue' then it's okay, but if it's just for convenience (aka laziness) in order to circumvent security protocols then it's a bad idea.