What happens after I enable any RBAC Role as PIM enabled role?

Question

I have a question on PIM (Privileged Identity Management). Let say, Users A, B, C, D, E have Reader role on subscription ABC right now. This is standing permanent access before enabling PIM. Now, we enable PIM, enable on this ABC subscription on this Reader role. What happens to these all 5 users' Reader roles? Will standing access be revoked or still we can see standing access? 2nd question: How can we automatically migrate standing Role to PIM role without manual efforts? In same scenario mentioned above, what I want is, User A,B,C,D,E should be converted to Eligible Role instead of Active Assignments, how can we achieve that? Because I have 13k+ subscriptions with 100K+ users. If I sit and do manual PIM rollout, this is not feasible. Any help appreciated.

Answer 1

When you enable PIM, it will not affect any users with existing permanent access roles, this will stay as they are. If you wish to convert these from permanent to PIM roles you will need to go through the process to do so. If you don't want to do this manually, then you can use PowerShell and the PIM cmdlets to help do this for you, but there is no built-in automation to do so.