Azure AD PIM token lifetimes

[Gurdev Singh]

Does anyone know if Azure AD PIM has any impact on token lifetimes? I know an access token remains valid for 1 hour whereas a refresh token can have long life. Does this mean if user activates their role for only 30mins, they will continue to have privileged access for at least one hour unless user explicitly logs-out of the session.

[#2]

@Gurdev Singh Hi, the minimum amount of time you can utilize PIM for is 1h. But that doesn´t change my answer to your question. The user in this context would have privileged access for as long as the PIM role would allow him/her. I.e If the Role is configured for 1h, any user with access to that role would be approved for 1h in a privileged role. When the time limit is reached, the rights granted by the privileged role are revoked.

https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-ch...

Regards,

Viktor

[#3]

PIM does not affect token lifetime, but PIM is subject to token refresh and lifetime behavior:

https://www.easy365manager.com/pim-privileged-identity-management-token-refresh-and-lifetime/