Test PIM Approval When the Approver Is Away

Privileged Identity Management can make access available only when someone needs it. Approval adds another person to the decision. That person also becomes part of the route to fixing an outage.

Test this route when everyone is available, then repeat it with the usual approver deliberately absent from the exercise.

Start with one business-critical role

Choose a role needed for a credible operational task, such as investigating a service issue or changing an approved configuration. Define the minimum task that demonstrates the role works without making an unnecessary production change.

Identify the eligible administrator, configured approvers, required authentication and device conditions. Record the permitted activation duration and where the change or incident reference belongs.

Microsoft’s role settings guidance explains that settings apply per role. Do not assume testing one role proves that every role has the same approval or authentication path.

Include any separate access needed to reach the management portal, read the runbook and contact the approver. A procedure stored behind the service being repaired can be unavailable at exactly the wrong time.

Give approval a staffed operating model

Microsoft’s approval workflow allows delegated users or groups to approve requests. Approvers cannot approve their own activation. Pending requests expire after a fixed 24-hour approval window if they remain unapproved.

That window is a product limit, not a suitable response target for every incident. Agree an internal target based on the service and its support hours.

Use at least two suitably informed approvers, as Microsoft recommends. Confirm their actual availability rather than counting two names that share the same working pattern, holiday or dependency.

An approver should understand what is being requested. Give them a clear role, task, duration and ticket reference. A vague “urgent access needed” request leaves them choosing between delaying the response and approving something they cannot assess.

The ticket field does not validate a ticketing system entry for you. Decide who checks that the reference is meaningful.

Look for circular dependencies

Review how the approver gets into PIM. If the approver needs another approval to reach the necessary environment, identify who can provide it. Follow that chain until there is a usable starting point.

Microsoft describes a specific lockout case: all relevant high-privilege assignments are eligible, activation requires approval, and no specific approvers are configured. The default approvers depend on active administrators, leaving no one able to approve.

Correct the design before reducing the last active dependency. Keep emergency access available through its separately controlled procedure. It must not require the same unavailable PIM approval that it exists to recover.

This does not make an emergency account the normal answer to a slow approval. Repeated use for routine changes is evidence that the operating model needs repair.

Run the absence drill

Use a planned test with the normal approver unavailable by agreement. Tell the alternate approver this is an exercise; there is no value in creating a surprise security incident.

Record the following:

Also submit a clearly invalid test request for the approver to deny, using the agreed exercise process. Approval coverage should demonstrate that the approver can recognise and refuse an inappropriate request.

Measure the time between stages. A long delay finding the notification calls for a different fix from a Conditional Access failure after approval.

Turn each failure into a specific correction

A missing approver needs coverage. An unreadable runbook needs an accessible copy. A failed authentication requirement needs a supported recovery route. A role that is too broad needs a revised task and permission choice.

Do not remove the approval requirement globally to conceal one of these problems. Change the component responsible and repeat the affected test.

Keep the evidence with the privileged-role cleanup record. Repeat the drill after approver departures, role-policy changes or a major change to the support rota.

References

• Microsoft — Approve or deny Microsoft Entra role requests. Accessed 17 October 2026.
• Microsoft — Configure Microsoft Entra role settings in PIM. Accessed 17 October 2026.
• Microsoft — Manage emergency access accounts. Accessed 17 October 2026.