Forum Discussion

smereczynski's avatar
smereczynski
Copper Contributor
Sep 23, 2024
Solved

PAL with PIM

Hi, Is PAL tracking the ACR from the client's subscriptions, where my account is added as eligible for proper RBAC role but not having active assignment for most of the time?
benefits
incentives
  • JillArmourMicrosoft's avatar
    JillArmourMicrosoft
    Apr 15, 2026

    I FINALLY heard back from the team on this one. I am not familiar with this content, but I hope it makes sense to you? 

    -------------------------------------------

    If PIM isn’t active and the account is JIT-only, what’s the operational guidance for enabling PAL?

    • PAL relies on active permissions, because it must identify partner-associated permissions on the customer tenant.
    • JIT removes standing permissions, which creates a conflict unless PIM or another mechanism reactivates temporary privileged roles long enough for PAL to validate associations.

     

    This is why customers on strict JIT/PIM-disabled models often cannot maintain PAL associations — and Microsoft does not currently offer an alternate mechanism

MichielGedopt's avatar
MichielGedopt
Copper Contributor
Oct 12, 2026

I just stumbled on this thread thanks to copilot researcher who found it for me. :)
finally a thread where PIM & PAL confirms what we have been trying to explain to Microsoft for 4 years!

following this thread going forward. 

unfortunately this is the same information I had, that PAL is not compatible and/or does not follows Microsoft security best practices, requiring a permanent permission that currently companies are removing.