Can we Configure AAD Roles assignment Automatically for few hours and expire?

[AmirShahzad]

Hi All,

I would really appreciate your input into the following:

Can we Configure AAD Roles assignment Automatically for few hours and expire? We have E5 licenses assigned to all users and upgraded AAD to P2.

The Management is asking if it is possible with Azure AD Governance PIM feature that:

We should have only two users as global Admins. 

All other Users who need Admin privilege from time to time may "request" AAD Role Assignment i.e. Sharepoint Administrator or Teams Administrator etc gets assigned automatically the role for a limited time like few hours and then this role expires(UnAssigned)  automatically as well. When the Tech support L1 or L2 needs it again then request and get assigned for few hours again. 

Also For more critical roles like Application Administrator or Global Administrator the L1 / L2 support admins need to request the role and the role be manually assigned, for few hours, not months / year.

Does AAD PIM offer few hour activation as well?

Any help would be greatly appreciated.

Regards,

Amir.

[#2 · Accepted solution]

@AmirShahzad The Azure AD Privileged Identity Management (PIM) service also allows Privileged role administrators to make permanent admin role assignments. Additionally, Privileged role administrators can make users eligible for Azure AD admin roles. An eligible administrator can activate the role when they need it, and then their permissions expire once they're done.
refer to below link to see how to configure it
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-ad...

[#3]

@AmirShahzad appreciate if you could mark my response as correct answer/best response if it did provide the information to your query, that will help us better understand what kind of information actually helps.

[#4]

Thank you for the reply.