Group expiration page is accesible with direct role assigment for user

Question

Group expiration page is accesible with direct role assigment for user

j prasad 31

When we assign global admin role to the user he can access group expiration .But,an Azure AD global admin role that is granted via a group they cannot access the Group Expriation settings. But if they are directly assigned the Azure AD role they can see the settings.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Shweta Mathur 30,471 Reputation points Microsoft Employee Moderator

2023-08-31T05:51:54.9+00:00

Hi @j prasad ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer accepted by question author

0 additional answers

Shweta Mathur 30,471 Reputation points Microsoft Employee Moderator

2023-08-31T05:51:54.9+00:00

Hi @j prasad ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Shweta Mathur 30,471 Microsoft Employee Moderator

Hi @j prasad ,

Thanks for reaching out.

Your understanding is correct here.

If a user is assigned the Global Administrator role directly, they will have access to the Group Expiration settings. However, if the Global Administrator role is granted via a group, they will not have access to the Group Expiration settings**.**

This is because group-based permissions are evaluated differently than direct permissions. In the case of direct permissions, the user is granted the permission directly, without any intermediary group**.** This means that the user has permission regardless of any group membership.

In the case of group-based permissions, the user is granted permission through membership in a group**.** This means that the user only has permission if they are a member of the group that has been granted the permission.

When a user has both direct and group-based permissions, the more restrictive permission takes precedence.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Rajat Chauhan 5 Reputation points

2023-12-29T02:16:26.2433333+00:00

Hi Team,

I also stuck on the similar issue, and I cross checked that if we are enabling PIM on group and assign the required roles even, we are not able to access the group expiration in Microsoft Entra ID.

In meanwhile if I applied the direct assignment role like User administrator, Group administrator or Global administrator roles, I could easily see the group expiration settings.
David Phillips 0 Reputation points

2024-07-29T18:13:05.58+00:00

How does this answer the original question? Whether the global admin or groups admin roles are assigned directly or via group should have no bearing on which settings are accessible via those two roles.
Michael Rask Christensen 5 Reputation points

2026-07-06T09:25:18.5+00:00

So, Microsoft has enforced a solution that contradicts all pieces of advice (from Microsoft) about using no standing privileges and just in time provisioning :-)