A license true-up drops your Entra ID P2 seat count below what's actually assigned. Someone decides it's fine — Conditional Access will just keep running on whatever's already configured, right? For Conditional Access, that assumption happens to be correct. For Privileged Identity Management, sitting right next to it in the same P2 SKU, it is not. When a P2 or Entra ID Governance license lapses, Microsoft's own documentation states plainly that PIM's eligible role assignments are removed — not paused, not disabled, removed — while every permanent, standing assignment in the same tenant is left completely untouched.
That asymmetry is the whole point of this post. Two features licensed by the same SKU, sitting in the same admin center, behave in opposite ways the moment the license goes away. If you don't know which is which before it happens, you find out the hard way.
The problem — the same license lapsing does two completely different things
Here's what Microsoft Learn actually documents for Conditional Access when the required license expires:
Now here's what happens to Privileged Identity Management when the same class of license — Entra ID P2, Entra ID Governance, or a trial covering either — expires:
Read that last part again: permanent role assignments to Entra ID roles are unaffected. So the admin who was deliberately moved to time-boxed, approval-gated, reviewed access through PIM loses that arrangement entirely and reverts to having no access at all until someone re-grants it — while an admin who was left as a standing, permanent Global Administrator the whole time never notices a thing. The license lapse doesn't just fail to protect you. It specifically dismantles the control you put in place, while leaving the exact risk that control existed to reduce completely intact.
Why it happens — one feature is designed to survive, the other isn't
The Conditional Access behaviour is a deliberate product decision. Microsoft states the reason directly: policies freeze in place so a licensing change doesn't cause "a sudden change in security posture." A frozen Conditional Access policy is still evaluated on every sign-in — it just can't be edited anymore until the license comes back.
PIM's eligible assignments don't have an equivalent frozen state, because of how they're structured. An eligible assignment isn't a policy sitting statically in a rules engine — it's a live, time-bound relationship between a principal and a role that depends on the PIM service actively managing activation windows, approval workflows, and expiry timers. Take away the license that entitles the tenant to run that service, and there's no "frozen" version of a relationship whose entire purpose was to be temporary and centrally managed. The eligible assignment record is deleted because the mechanism that gave it meaning is gone.
The standing assignment survives for the opposite reason: it was never a PIM object in the first place. A permanent role assignment lives as a plain directory role membership — the same kind of object PIM audits for in the first place (see the standing admin role audit on this site). PIM licensing gates the ability to manage that membership through activation and review workflows. It was never required for the membership to exist at all.
How to verify — check license coverage before you touch seat counts, not after
Microsoft's own licensing guidance for PIM lists five categories of user that specifically need a Entra ID P2 or Entra ID Governance license for PIM to keep functioning as designed:
- Users with eligible and/or time-bound assignments to Entra ID or Azure roles managed using PIM
- Users with eligible and/or time-bound assignments as members or owners of PIM for Groups
- Users able to approve or reject activation requests in PIM
- Users assigned to an access review
- Users who perform access reviews
Before you reduce P2 seats, check the actual licensed state of everyone in those five categories — not just whoever the license true-up flags as "unassigned." The cleanest way to resolve the correct SKU to check against is Get-MgSubscribedSku, since the exact SkuPartNumber string for Entra ID P2 versus Entra ID Governance can differ between tenants depending on how the SKU was purchased.
- Navigate to the path shown above, then select Roles
- Open each privileged role and check the Eligible tab count separately from the Active tab count
- Do the same for Groups under PIM if PIM for Groups is in use — eligible ownership and membership both count
- Cross-check the approvers configured on each role's activation settings — they need a license too, even if they never hold the role themselves
The fix — inventory PIM-licensed users before reducing seats, and re-escrow eligible access immediately if a lapse already happened
- Before any planned reduction in Entra ID P2 or Entra ID Governance seats, run the companion script below to get an exact count of principals who currently depend on that license for PIM specifically — not just the tenant's overall "assigned vs available" license report, which doesn't distinguish PIM-dependent users from anyone else holding the SKU for other P2 features.
- If a lapse has already happened, re-run the standing admin role audit script from the earlier post immediately. Every account it flags as a standing, non-PIM-eligible assignment on a sensitive role — including ones that were eligible before the lapse and are now standing by omission because nobody re-created them — is now completely unmanaged.
- Re-create the eligible assignments and approval/review configuration manually once the license is restored. Microsoft's documentation is explicit that PIM does not restore the deleted eligible assignments automatically when the license comes back — you're rebuilding the PIM configuration from scratch, not resuming it.
- Set a recurring calendar reminder tied to license renewal dates, not just a one-off check. A license that renews automatically today can still lapse later from a true-up, a plan change, or an accidental seat reduction during a cost-cutting pass.
Proof it worked — Test-PimLicenseCoverage.ps1
This script cross-references every principal currently holding a PIM-eligible assignment, PIM for Groups membership, or configured approver role against their actual assigned Microsoft 365 licenses, and flags anyone who does not currently hold the Entra ID P2 or Entra ID Governance SKU your tenant relies on for PIM. It is genuinely read-only — it makes no license or role assignment changes of any kind.
Test-PimLicenseCoverage.ps1 is free and open source. It's a genuinely read-only check — no writes to PIM, role assignments, or licenses.