Tim Microsoft Cloud Solution Architect

PIM Workaround for Exchange and Intune

PIM Workaround for Exchange and Intune

PIM Workaround for Exchange and Intune

Disclaimer: This is just a workaround until the Product Group fix the issue that some roles are not in scope of Azure AD Right Management


Currently there is no way to address Custom roles in Exchange or Intune through Azure Privileged Identity Management. Which means that there are some black spot there is no way to use PIM for this kind of Roles.


Use role-assignable groups and PIM for groups. By that there is a way to address such roles with PIM. Not the normal way but it is a workaround for it.


  1. Create a Role-assignable group


  2. Assign this group in Exchange or Intune to the specific Role


  3. Enable PIM


  4. Create PIM Privileged access groups (preview) Config



Some Note´s

  • Admin need to go over PIM Groups and not PIM Roles

  • there are sometimes sync delays which means the Role is not instead active

  • The PIM Report is not covering this aspect and will not shown the additional Role Assignments

  • PAG are protected for Roles like “Group Administrator”

  • Analyze the audit logs if there is an direct assignment for the new protected Roles