Azure PIM Member of a role expiring in 14 days

Question

Azure PIM Member of a role expiring in 14 days

MrFlinstone 766

Hi All.

We have got PIM configured for Azure tenant roles, however a role assignment expiry email was received advising that the role will expire in 14 days, the PIM configuration was set up such that its permanently eligible, how can one configure it such that membership of the group is set to permanent rather than having an expiry date. Ideally we don't want users receiving emails advising them of an expiry, the roles are permanently required for day to day activities and should not expire.

On trying to click on extend when on PIM, I get the message An inherited or group assignment cannot be extended.

Further clarification will be required here.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T09:59:21.6833333+00:00

Hello MrFlinstone,

The behavior appears to be related to the assignment being inherited through a group, as indicated by the message:

"An inherited or group assignment cannot be extended."

For Microsoft Entra roles, PIM sends notifications when role assignments are approaching expiration. Users can request an extension for eligible or active assignments assigned directly to them; however, inherited group-based assignments cannot be extended by the user.

Could you confirm whether the role is assigned directly to the user or through a role-assignable group? If it is a group-based assignment, please also share whether the group membership itself is configured as permanent or time-bound.

This will help determine whether the expiration notification is related to the role assignment or the underlying group membership.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-renew-extend
MrFlinstone 766 Reputation points

2026-06-01T10:16:00.81+00:00

The role assignment was through a role assignable group.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T10:18:17.7166667+00:00

Hello MrFlinstone,

Thanks for confirming that the role is assigned through a role-assignable group.

I would recommend reviewing the PIM settings for the group, particularly the Assignment duration configuration for Members. If the current membership was created as a time-bound assignment, PIM will continue to send expiration notifications based on that assignment.

Please verify whether permanent eligible or permanent active assignments are allowed for the group, and whether the affected membership was originally assigned using one of those options. If the membership is time-bound, it may need to be reassigned with the appropriate duration to prevent future expiration notifications.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#assignment-duration
MrFlinstone 766 Reputation points

2026-06-01T11:16:20.8433333+00:00

Please note that its permanent eligible, yet a reminder is being sent a year after the group became active. It would be good to understand why this is happening as we would want to prevent a situation where users are unable to PIM at the 1 year anniversary.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T12:00:53.2633333+00:00

Hello MrFlinstone,

Thank you for sharing the screenshot.

I can see that the eligible assignment is configured with an End time of Permanent. Given that, the expiration notification does not appear to be coming from the role assignment shown in the screenshot.

Could you confirm whether the notification references the role assignment itself or the membership in the role-assignable group? If possible, please share a screenshot of the email notification (with any sensitive information removed).

This will help determine whether the notification is related to the Microsoft Entra role assignment, the underlying group membership, or another PIM assignment associated with the account.
MrFlinstone 766 Reputation points

2026-06-01T12:08:10.2433333+00:00

See the email received below. If one opens the link, can see a list of all groups where membership of the role is assigned and here one can either click on activate or extend.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T12:32:41.7033333+00:00

Hello MrFlinstone,

Thank you for the additional information.

The role assignment shown in your screenshot is configured as Permanent, so the notification does not appear to be related to that assignment directly.

Since the email links to a page where Activate and Extend actions are available, PIM appears to be detecting an assignment that is approaching its expiration date. To better understand which assignment is triggering the notification, could you share a screenshot of the assignment details page that opens from the email, including the expiration date shown there (with any sensitive information removed)?

This will help determine whether the notification is related to the underlying group membership assignment or another PIM assignment associated with the role-assignable group.

Reference: Extend or renew Microsoft Entra role assignments in PIM
MrFlinstone 766 Reputation points

2026-06-01T14:02:12.5566667+00:00

I have checked again and i can see that the alert was for a secondary account with thesame email address for notifications, on that account the expiry date is set for 2 weeks time, how can this be changed to make it permanent, the account in question is part of a group, if i click on extend I get the prompt An inherited or group assignment cannot be extended.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T15:21:09.01+00:00

Hello MrFlinstone,

Thank you for confirming.

Since the affected account's assignment is due to expire in two weeks and is inherited through a role-assignable group, the message "An inherited or group assignment cannot be extended" is expected. Inherited assignments cannot be extended from the user account.

To make the assignment permanent, the change must be made at the source of the assignment rather than on the inherited role assignment itself. Please review the configuration of the role-assignable group and the membership assignment associated with the affected account to determine whether it was created as a time-bound assignment.

If the membership assignment is time-bound, a group administrator can modify or recreate the assignment using a permanent duration, subject to the group's PIM policy settings.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#assignment-duration

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T09:59:21.6833333+00:00

Hello MrFlinstone,

The behavior appears to be related to the assignment being inherited through a group, as indicated by the message:

"An inherited or group assignment cannot be extended."

For Microsoft Entra roles, PIM sends notifications when role assignments are approaching expiration. Users can request an extension for eligible or active assignments assigned directly to them; however, inherited group-based assignments cannot be extended by the user.

Could you confirm whether the role is assigned directly to the user or through a role-assignable group? If it is a group-based assignment, please also share whether the group membership itself is configured as permanent or time-bound.

This will help determine whether the expiration notification is related to the role assignment or the underlying group membership.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-renew-extend
MrFlinstone 766 Reputation points

2026-06-01T10:16:00.81+00:00

The role assignment was through a role assignable group.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T10:18:17.7166667+00:00

Hello MrFlinstone,

Thanks for confirming that the role is assigned through a role-assignable group.

I would recommend reviewing the PIM settings for the group, particularly the Assignment duration configuration for Members. If the current membership was created as a time-bound assignment, PIM will continue to send expiration notifications based on that assignment.

Please verify whether permanent eligible or permanent active assignments are allowed for the group, and whether the affected membership was originally assigned using one of those options. If the membership is time-bound, it may need to be reassigned with the appropriate duration to prevent future expiration notifications.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#assignment-duration
MrFlinstone 766 Reputation points

2026-06-01T11:16:20.8433333+00:00

Please note that its permanent eligible, yet a reminder is being sent a year after the group became active. It would be good to understand why this is happening as we would want to prevent a situation where users are unable to PIM at the 1 year anniversary.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T12:00:53.2633333+00:00

Hello MrFlinstone,

Thank you for sharing the screenshot.

I can see that the eligible assignment is configured with an End time of Permanent. Given that, the expiration notification does not appear to be coming from the role assignment shown in the screenshot.

Could you confirm whether the notification references the role assignment itself or the membership in the role-assignable group? If possible, please share a screenshot of the email notification (with any sensitive information removed).

This will help determine whether the notification is related to the Microsoft Entra role assignment, the underlying group membership, or another PIM assignment associated with the account.
MrFlinstone 766 Reputation points

2026-06-01T12:08:10.2433333+00:00

See the email received below. If one opens the link, can see a list of all groups where membership of the role is assigned and here one can either click on activate or extend.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T12:32:41.7033333+00:00

Hello MrFlinstone,

Thank you for the additional information.

The role assignment shown in your screenshot is configured as Permanent, so the notification does not appear to be related to that assignment directly.

Since the email links to a page where Activate and Extend actions are available, PIM appears to be detecting an assignment that is approaching its expiration date. To better understand which assignment is triggering the notification, could you share a screenshot of the assignment details page that opens from the email, including the expiration date shown there (with any sensitive information removed)?

This will help determine whether the notification is related to the underlying group membership assignment or another PIM assignment associated with the role-assignable group.

Reference: Extend or renew Microsoft Entra role assignments in PIM
MrFlinstone 766 Reputation points

2026-06-01T14:02:12.5566667+00:00

I have checked again and i can see that the alert was for a secondary account with thesame email address for notifications, on that account the expiry date is set for 2 weeks time, how can this be changed to make it permanent, the account in question is part of a group, if i click on extend I get the prompt An inherited or group assignment cannot be extended.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-01T15:21:09.01+00:00

Hello MrFlinstone,

Thank you for confirming.

Since the affected account's assignment is due to expire in two weeks and is inherited through a role-assignable group, the message "An inherited or group assignment cannot be extended" is expected. Inherited assignments cannot be extended from the user account.

To make the assignment permanent, the change must be made at the source of the assignment rather than on the inherited role assignment itself. Please review the configuration of the role-assignable group and the membership assignment associated with the affected account to determine whether it was created as a time-bound assignment.

If the membership assignment is time-bound, a group administrator can modify or recreate the assignment using a permanent duration, subject to the group's PIM policy settings.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#assignment-duration