HomeNewsletterCommunityMVP FeedToolsArchiveBlogToday's NewsAboutServicesQuick Links Subscribe free
← Back to Blog

A Lapsed Entra ID P2 License Doesn't Pause PIM — It Deletes Every Eligible Assignment

IA
Imran Awan
28 July 2026

A license true-up drops your Entra ID P2 seat count below what's actually assigned. Someone decides it's fine — Conditional Access will just keep running on whatever's already configured, right? For Conditional Access, that assumption happens to be correct. For Privileged Identity Management, sitting right next to it in the same P2 SKU, it is not. When a P2 or Entra ID Governance license lapses, Microsoft's own documentation states plainly that PIM's eligible role assignments are removed — not paused, not disabled, removed — while every permanent, standing assignment in the same tenant is left completely untouched.

That asymmetry is the whole point of this post. Two features licensed by the same SKU, sitting in the same admin center, behave in opposite ways the moment the license goes away. If you don't know which is which before it happens, you find out the hard way.

The problem — the same license lapsing does two completely different things

Here's what Microsoft Learn actually documents for Conditional Access when the required license expires:

Conditional Access, on license expiry: "policies aren't automatically disabled or deleted. This grants customers the ability to migrate away from Conditional Access policies without a sudden change in their security posture. Remaining policies can be viewed and deleted, but no longer updated."

Now here's what happens to Privileged Identity Management when the same class of license — Entra ID P2, Entra ID Governance, or a trial covering either — expires:

PIM, on license expiry: eligible role assignments of Entra ID roles are removed. Any ongoing access reviews of Entra ID roles end, and PIM configuration settings are removed. PIM stops sending emails on role assignment changes. The PIM service, its Graph API, and its PowerShell interfaces stop being available for activation, managing privileged access, or performing access reviews.

Read that last part again: permanent role assignments to Entra ID roles are unaffected. So the admin who was deliberately moved to time-boxed, approval-gated, reviewed access through PIM loses that arrangement entirely and reverts to having no access at all until someone re-grants it — while an admin who was left as a standing, permanent Global Administrator the whole time never notices a thing. The license lapse doesn't just fail to protect you. It specifically dismantles the control you put in place, while leaving the exact risk that control existed to reduce completely intact.

Why it happens — one feature is designed to survive, the other isn't

The Conditional Access behaviour is a deliberate product decision. Microsoft states the reason directly: policies freeze in place so a licensing change doesn't cause "a sudden change in security posture." A frozen Conditional Access policy is still evaluated on every sign-in — it just can't be edited anymore until the license comes back.

PIM's eligible assignments don't have an equivalent frozen state, because of how they're structured. An eligible assignment isn't a policy sitting statically in a rules engine — it's a live, time-bound relationship between a principal and a role that depends on the PIM service actively managing activation windows, approval workflows, and expiry timers. Take away the license that entitles the tenant to run that service, and there's no "frozen" version of a relationship whose entire purpose was to be temporary and centrally managed. The eligible assignment record is deleted because the mechanism that gave it meaning is gone.

The standing assignment survives for the opposite reason: it was never a PIM object in the first place. A permanent role assignment lives as a plain directory role membership — the same kind of object PIM audits for in the first place (see the standing admin role audit on this site). PIM licensing gates the ability to manage that membership through activation and review workflows. It was never required for the membership to exist at all.

Gotcha: if your remediation plan for standing admin access was "convert everyone to PIM-eligible," a license lapse can silently undo that entire remediation. The people you converted to eligible lose access outright (a service disruption you'll hear about immediately). Anyone you missed and left standing keeps their permanent access with nobody watching (a security gap you won't hear about at all). Both outcomes point the same direction: fewer people under active PIM control, not more.

How to verify — check license coverage before you touch seat counts, not after

Microsoft's own licensing guidance for PIM lists five categories of user that specifically need a Entra ID P2 or Entra ID Governance license for PIM to keep functioning as designed:

Before you reduce P2 seats, check the actual licensed state of everyone in those five categories — not just whoever the license true-up flags as "unassigned." The cleanest way to resolve the correct SKU to check against is Get-MgSubscribedSku, since the exact SkuPartNumber string for Entra ID P2 versus Entra ID Governance can differ between tenants depending on how the SKU was purchased.

Windows PowerShell — resolve the real SKU name in your tenant
Get-MgSubscribedSku -All | Select-Object SkuPartNumber, ConsumedUnits, @{N='Total';E={$_.PrepaidUnits.Enabled}} # Look for something like AAD_PREMIUM_P2 (Entra ID P2) or a Governance/Suite SKU # — the exact SkuPartNumber string is tenant-specific, always confirm it here # rather than assuming the well-known name matches what your tenant was sold.
Confirming the count of PIM-eligible principals manually first
  1. Navigate to the path shown above, then select Roles
  2. Open each privileged role and check the Eligible tab count separately from the Active tab count
  3. Do the same for Groups under PIM if PIM for Groups is in use — eligible ownership and membership both count
  4. Cross-check the approvers configured on each role's activation settings — they need a license too, even if they never hold the role themselves
Note: there's no Group Policy or Intune CSP equivalent for any of this. Licensing entitlement and PIM configuration live entirely inside Entra ID's cloud control plane — there's no device-side setting involved, so this isn't something a device configuration profile or GPO can enforce or protect against.

The fix — inventory PIM-licensed users before reducing seats, and re-escrow eligible access immediately if a lapse already happened

  1. Before any planned reduction in Entra ID P2 or Entra ID Governance seats, run the companion script below to get an exact count of principals who currently depend on that license for PIM specifically — not just the tenant's overall "assigned vs available" license report, which doesn't distinguish PIM-dependent users from anyone else holding the SKU for other P2 features.
  2. If a lapse has already happened, re-run the standing admin role audit script from the earlier post immediately. Every account it flags as a standing, non-PIM-eligible assignment on a sensitive role — including ones that were eligible before the lapse and are now standing by omission because nobody re-created them — is now completely unmanaged.
  3. Re-create the eligible assignments and approval/review configuration manually once the license is restored. Microsoft's documentation is explicit that PIM does not restore the deleted eligible assignments automatically when the license comes back — you're rebuilding the PIM configuration from scratch, not resuming it.
  4. Set a recurring calendar reminder tied to license renewal dates, not just a one-off check. A license that renews automatically today can still lapse later from a true-up, a plan change, or an accidental seat reduction during a cost-cutting pass.
Tip: you don't need to over-license defensively. The fix here is precision, not buying more seats than you need — run the coverage script, license exactly the principals in the five PIM-dependent categories, and you've closed the gap without paying for seats nobody is actually using PIM through.

Proof it worked — Test-PimLicenseCoverage.ps1

This script cross-references every principal currently holding a PIM-eligible assignment, PIM for Groups membership, or configured approver role against their actual assigned Microsoft 365 licenses, and flags anyone who does not currently hold the Entra ID P2 or Entra ID Governance SKU your tenant relies on for PIM. It is genuinely read-only — it makes no license or role assignment changes of any kind.

Download the script — GitHub

Test-PimLicenseCoverage.ps1 is free and open source. It's a genuinely read-only check — no writes to PIM, role assignments, or licenses.

Test-PimLicenseCoverage.ps1 View full repo →
Example output below is illustrative, not a live-tenant capture. It matches the script's real structure and message wording, with fictional tenant/user values, so you can see what a run looks like before testing it yourself.
Test-PimLicenseCoverage.ps1 — example output (illustrative)
.\Test-PimLicenseCoverage.ps1 -SkuPartNumber "AAD_PREMIUM_P2" Connecting to Microsoft Graph... Connected as: admin@contoso.onmicrosoft.com Tenant: 11111111-2222-3333-4444-555555555555 Resolving SKU 'AAD_PREMIUM_P2' in this tenant... Found: AAD_PREMIUM_P2 (42 of 50 seats consumed) Enumerating PIM-eligible role assignments (roleEligibilityScheduleInstance)... Found 18 eligible assignment instance(s) across 9 principal(s) Enumerating PIM for Groups eligible memberships/ownerships... Found 4 eligible instance(s) across 3 principal(s) Enumerating configured approvers on privileged role policies... Found 3 distinct approver principal(s) Cross-referencing 14 unique PIM-dependent principal(s) against SKU 'AAD_PREMIUM_P2'... ============================================================ PIM LICENSE COVERAGE REPORT ============================================================ [OK ] j.mercer@contoso.com Eligible: Global Administrator Licensed: Yes [OK ] r.oduya@contoso.com Approver: Privileged Role Administrator Licensed: Yes [MISS] s.connor@contoso.com Eligible: Security Administrator Licensed: No <-- would lose eligibility on next renewal [MISS] svc-pimreview@contoso.com Reviewer: Access Review (Quarterly) Licensed: No <-- would lose eligibility on next renewal ------------------------------------------------------------ Total PIM-dependent principals checked : 14 Licensed correctly : 12 MISSING required license : 2 ------------------------------------------------------------ This script performed read-only Graph queries only. No licenses or role assignments were changed.
Gotcha: a "MISS" here does not mean that principal has lost access right now — it means their PIM-dependent access is currently riding on someone else's spare seat capacity or a license that could be reassigned out from under them at any point, since nothing is formally holding that license against their specific PIM dependency. Treat every MISS as something to license correctly before the next seat reduction, not an active outage.

References

Share this post
LinkedIn X / Twitter Reddit Bluesky

More from EndpointWeekly

Entra ID
PIM Standing Admin Role Audit
The audit script this post's remediation step reuses.
Security
Entra Conditional Access Coverage Gap Audit
The other half of this same P2 SKU, and why it survives a license lapse.
Security
App Registration Secrets & Certificates Expiry Audit
Another expiry that fails silently until someone checks for it.