add assignment scope type

Lab 26: Configure Privileged Identity Management for Microsoft Entra roles

Lab scenario.

A Privileged role administrator can customize Privileged Identity Management (PIM) in their Microsoft Entra organization, including changing the experience for a user who is activating an eligible role assignment. You must become familiar with configuring PIM.

Estimated time: 30 minutes

NOTE - There have been on-going changes to requiring MFA in lab environments. When you switch between users to complete this lab, you may be prompted to set up MFA.

Exercise 1 - Configure Microsoft Entra role settings

Task 1 - open role settings.

Follow these steps to open the settings for an Microsoft Entra role.

Sign in to the  https://entra.microsoft.com  as a Global administrator.

Search for and then select Privileged Identity Management.

In the Privileged Identity Management page, in the left navigation, select Microsoft Entra roles.

On the Quick start page, in the left navigation, select Settings.

Review the list of roles and then, in the Search by role name , enter compliance .

In the results, select Compliance Administrator .

Review the role setting details information.

Task 2 - Require approval to activate

If setting multiple approvers, approval completes as soon as one of them approves or denies. You cannot require approval from at least two users. To require approval to activate a role, follow these steps.

In the Role setting details page, on the top menu, select Edit .

In the Edit role setting – Compliance Administrator page, select the Require approval to activate check box.

Select Select approvers .

In the Select a member pane, select your administrator account and then select Select .

Once you have configured the role settings, select Update to save your changes.

Exercise 2 - PIM with Microsoft Entra roles

Task 1 - assign a role.

With Microsoft Entra ID, a Global administrator can make permanent Microsoft Entra admin role assignments. These role assignments can be created using the Microsoft Entra admin center, the Azure portal, or using PowerShell commands.

The Privileged Identity Management (PIM) service also allows Privileged role administrators to make permanent admin role assignments. Additionally, Privileged role administrators can make users eligible for Microsoft Entra admin roles. An eligible administrator can activate the role when they need it, and then their permissions expire once they’re done.

Follow these steps to make a user eligible for an Microsoft Entra admin role.

Sign in to https://entra.microsoft.com using a Global Administrator account.

Note - you can find it in the menu at Identity - Identity Governance - Privileged Identity Management.

On the Quick start page, in the left navigation, select Roles .

On the top menu, select + Add assignments.

In the Add assignments page, on the Membership tab, review the settings.

Select the Select role menu and then select Compliance Administrator .

You can use the Search role by name filter to help located a role.

Under Select member(s), select No members selected .

In the Select a member pane, select Miriam Graham and then select Select .

In the Add assignments page, select Next .

On the Settings tab, under Assignment type , review the available options. For this task, use the default setting.

• Eligible assignments require the member of the role to perform an action to use the role. Actions might include performing a multi-factor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers.
• Active assignments do not require the member to perform any action to use the role. Members assigned as active have the privileges always assigned to the role.

Review the remaining settings and then select Assign .

Task 2 - Log in with Miriam

• Open a new InPrivate browser window.
• Connect to the Microsoft Entra admin center (https://entra.microsoft.com). Note - If it opens with a user logged in, Select on their name in the upper-right corner and select Sign in as a different account .

Log in a Miriam.

• From the Identity menu, open Users and then select All users .
• Find Miriam in the list of users
• On the Overview page, look for the Assigned roles .
• Select Eligible assignments .
• Notice that the Compliance Administrator role is now available to Miriam.

Task 3 - Activate your Microsoft Entra roles

When you need to assume an Microsoft Entra role, you can request activation by opening My roles in Privileged Identity Management.

• From the Search, resources, services, and docs bar, look for Privileged.
• Open the Privileged Identity Management page.

On the Privileged Identity Management page, in the left navigation menu, select My roles.

In the My roles page, review the list of Eligible assignments .

In the Compliance Administrator role row, select Activate .

In the Activate – Compliance Administrator pane, select Additional verification required and then follow the instructions to provide additional security verification. You are required to authenticate only once per session.

Verification - Based on our current lab environment configuration, you will be required configure MFA and log in successfully.

After you have completed the additional security verification, in the Activate – Compliance Administrator pane, in the Reason box, enter the This is my justification for activating this role .

Important Note - the principal of least prvilege, you should only activate the account for the amount of time you need it. If the work needed to be done, only takes 1.5 hours, then set the duration to two hours. Similarily, if you know that you won’t be able to do the work until after 3pm, choose a Custom activation time.

• Select Activate .

Task 4 - Assign a role with restricted scope

For certain roles, the scope of the granted permissions can be restricted to a single admin unit, service principal, or application. This procedure is an example if assigning a role that has the scope of an administrative unit.

• Remember to close out the browser windows for MiriamG, then open the Microsoft Entra admin center with your administrator account.
• Browse to the Privileged Identity Management page, and in the left navigation menu, select Azure Microsoft Entra roles.
• Select Roles .

In the Roles page, on the top menu, select + Add assignments.

In the Add assignments page, select the Select role menu and then select User administrator.

Select the Scope type menu and review the available options. For now, you will use the Directory scope type.

Tip - Go to https://docs.microsoft.com/en-us/azure/active-directory/roles/admin-units-manage for more information about the administrative unit scope type.

• As you did when assigning a role without a restricted scope, you would add members and complete the settings options. For now, select Cancel .

Task 5 - Update or remove an existing role assignment

Follow these steps to update or remove an existing role assignment.

In the Open Privileged Identity Management > Microsoft Entra roles page, in the left navigation, select Assignments .

In Assignments list, for Compliance Administrator, review the options in the Action column.

Select Update and review the options available in the Membership settings pane. When complete, close the pane.

Select Remove .

In the Remove dialog box, review the information and then select Yes .

Get the Reddit app

Intune is a Mobile Device Management service that is part of Microsoft's Enterprise Mobility + Security offering. Don't call it InTune.

Intune RBAC and Multiple Roles/Role Assignments

Is it possible to assign the same group of intune users/admins different levels of access to different groups of devices? I am testing these and it doesn't seem to work.

Imaginary example:

Custom Role 1: Devices-Read (Permissions to read devices, read config profiles etc.)

Role Assignment added with members "IT-Techs", scoped to "HR-Windows" and HR scope tag.

Custom Role 2: Devices-Update (Same as above but some additional update permissions)

Role Assignment added with members "IT-Techs", scoped to "Finance-Windows" and Finance scope tag.

Net result after waiting 48 hours... users can only see HR-Devices devices scoped in Role 1. Finance devices are completely not visible in Intune to these technicians. The roles work independently. For example if I assign Role 1 to a test group, that group can see HR-Windows devices with Read Access. If I remove that group from that role and add to the other and wait for it to apply, that group can see Finance-Windows devices and edit them (change primary user etc.) but not see HR-Devices.

If this is expected behavior, it would mean that a given group of technicians can only have the same level of permissions across all devices they can see?

I must be missing something!!

Edit: Kind of seeing this, but not exactly: Intune RBAC - How Intune Processes Multiple Assigned Roles · Dan Zabinski

By continuing, you agree to our User Agreement and acknowledge that you understand the Privacy Policy .

Enter the 6-digit code from your authenticator app

You’ve set up two-factor authentication for this account.

Enter a 6-digit backup code

Create your username and password.

Reddit is anonymous, so your username is what you’ll go by here. Choose wisely—because once you get a name, you can’t change it.

Reset your password

Enter your email address or username and we’ll send you a link to reset your password

Check your inbox

An email with a link to reset your password was sent to the email address associated with your account

Choose a Reddit account to continue

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

• Notifications You must be signed in to change notification settings

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add role assignment by using ARM template #67597

sovaska commented Dec 12, 2020

NavtejSaini-MSFT commented Dec 12, 2020

Sorry, something went wrong.

ghost commented Dec 22, 2020

ghost commented Dec 23, 2020

mike-urnun-msft commented Dec 30, 2020 • edited Loading

ghost commented Jan 14, 2021

ghost commented Jan 14, 2021 • edited by ghost Loading

tank104 commented Sep 15, 2021

ghost commented Sep 16, 2021 • edited by ghost Loading

• 👍 1 reaction

tank104 commented Sep 16, 2021

Shmirre commented Mar 16, 2023 • edited Loading

No branches or pull requests

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Assign Microsoft Entra roles in Privileged Identity Management

• 18 contributors

With Microsoft Entra ID, a Global Administrator can make permanent Microsoft Entra admin role assignments. These role assignments can be created using the Microsoft Entra admin center or using PowerShell commands .

The Microsoft Entra Privileged Identity Management (PIM) service also allows Privileged Role Administrators to make permanent admin role assignments. Additionally, Privileged Role Administrators can make users eligible for Microsoft Entra admin roles. An eligible administrator can activate the role when they need it, and then their permissions expire once they're done.

Privileged Identity Management support both built-in and custom Microsoft Entra roles. For more information on Microsoft Entra custom roles, see Role-based access control in Microsoft Entra ID .

When a role is assigned, the assignment:

• Can't be assigned for a duration of less than five minutes
• Can't be removed within five minutes of it being assigned

Assign a role

Follow these steps to make a user eligible for a Microsoft Entra admin role.

Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator .

Browse to Identity governance > Privileged Identity Management > Microsoft Entra roles .

Select Roles to see the list of roles for Microsoft Entra permissions.

Select Add assignments to open the Add assignments page.

Select Select a role to open the Select a role page.

Select a role you want to assign, select a member to whom you want to assign to the role, and then select Next .

If you assign a Microsoft Entra built-in role to a guest user, the guest user will be elevated to have the same permissions as a member user. For information about member and guest user default permissions, see What are the default user permissions in Microsoft Entra ID?

In the Assignment type list on the Membership settings pane, select Eligible or Active .

Eligible assignments require the member of the role to perform an action to use the role. Actions might include performing a multifactor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers.

Active assignments don't require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role at all times.

To specify a specific assignment duration, add a start and end date and time boxes. When finished, select Assign to create the new role assignment.

Permanent assignments have no expiration date. Use this option for permanent workers who frequently need the role permissions.

Time-bound assignments will expire at the end of a specified period. Use this option with temporary or contract workers, for example, whose project end date and time are known.

After the role is assigned, an assignment status notification is displayed.

Assign a role with restricted scope

For certain roles, the scope of the granted permissions can be restricted to a single admin unit, service principal, or application. This procedure is an example if assigning a role that has the scope of an administrative unit. For a list of roles that support scope via administrative unit, see Assign scoped roles to an administrative unit . This feature is currently being rolled out to Microsoft Entra organizations.

Browse to Identity > Roles & admins > Roles & admins .

Select the User Administrator .

​Select Add assignments .

On the Add assignments page, you can:

• Select a user or group to be assigned to the role
• Select the role scope (in this case, administrative units)
• Select an administrative unit for the scope

For more information about creating administrative units, see Add and remove administrative units .

Assign a role using Microsoft Graph API

For more information about Microsoft Graph APIs for PIM, see Overview of role management through the privileged identity management (PIM) API .

For permissions required to use the PIM API, see Understand the Privileged Identity Management APIs .

Eligible with no end date

The following is a sample HTTP request to create an eligible assignment with no end date. For details on the API commands including request samples in languages such as C# and JavaScript, see Create roleEligibilityScheduleRequests .

HTTP request

Http response.

The following is an example of the response. The response object shown here might be shortened for readability.

Active and time-bound

The following is a sample HTTP request to create an active assignment that's time-bound. For details on the API commands including request samples in languages such as C# and JavaScript, see Create roleAssignmentScheduleRequests .

Update or remove an existing role assignment

Follow these steps to update or remove an existing role assignment. Microsoft Entra ID P2 or Microsoft Entra ID Governance licensed customers only : Don't assign a group as Active to a role through both Microsoft Entra ID and Privileged Identity Management (PIM). For a detailed explanation, see Known issues .

Select Roles to see the list of roles for Microsoft Entra ID.

Select the role that you want to update or remove.

Find the role assignment on the Eligible roles or Active roles tabs.

Select Update or Remove to update or remove the role assignment.

Remove eligible assignment via Microsoft Graph API

The following is a sample HTTP request to revoke an eligible assignment to a role from a principal. For details on the API commands including request samples in languages such as C# and JavaScript, see Create roleEligibilityScheduleRequests .

• Configure Microsoft Entra admin role settings in Privileged Identity Management

Was this page helpful?

Additional resources

• Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
• Advertising & Talent Reach devs & technologists worldwide about your product, service or employer brand
• OverflowAI GenAI features for Teams
• OverflowAPI Train & fine-tune LLMs
• Labs The future of collective knowledge sharing
• About the company Visit the blog

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Get early access and see previews of new features.

How do you use "<<-" (scoping assignment) in R?

I just finished reading about scoping in the R intro , and am very curious about the <<- assignment.

The manual showed one (very interesting) example for <<- , which I feel I understood. What I am still missing is the context of when this can be useful.

So what I would love to read from you are examples (or links to examples) on when the use of <<- can be interesting/useful. What might be the dangers of using it (it looks easy to loose track of), and any tips you might feel like sharing.

• lexical-scope

• 1 I've used <<- to preserve key variables generated inside a function to record in failure logs when the function fails. Can help to make the failure reproducible if the function used inputs (e.g. from external APIs) that wouldn't necessarily have been preserved otherwise due to the failure. –  geotheory Commented Oct 9, 2020 at 11:59

7 Answers 7

<<- is most useful in conjunction with closures to maintain state. Here's a section from a recent paper of mine:

A closure is a function written by another function. Closures are so-called because they enclose the environment of the parent function, and can access all variables and parameters in that function. This is useful because it allows us to have two levels of parameters. One level of parameters (the parent) controls how the function works. The other level (the child) does the work. The following example shows how can use this idea to generate a family of power functions. The parent function ( power ) creates child functions ( square and cube ) that actually do the hard work.

The ability to manage variables at two levels also makes it possible to maintain the state across function invocations by allowing a function to modify variables in the environment of its parent. The key to managing variables at different levels is the double arrow assignment operator <<- . Unlike the usual single arrow assignment ( <- ) that always works on the current level, the double arrow operator can modify variables in parent levels.

This makes it possible to maintain a counter that records how many times a function has been called, as the following example shows. Each time new_counter is run, it creates an environment, initialises the counter i in this environment, and then creates a new function.

The new function is a closure, and its environment is the enclosing environment. When the closures counter_one and counter_two are run, each one modifies the counter in its enclosing environment and then returns the current count.

• 6 Hey this is an unsolved R task on Rosettacode ( rosettacode.org/wiki/Accumulator_factory#R ) Well, it was... –  Karsten W. Commented Apr 15, 2010 at 15:05
• 1 Would there be any need to enclose more than 1 closures in one parent function? I just tried one snippet, it seems that only the last closure was executed... –  Oliver Commented Feb 3, 2018 at 15:13
• Is there any equal sign alternative to the "<<-" sign? –  Saren Tasciyan Commented May 1, 2019 at 15:46

It helps to think of <<- as equivalent to assign (if you set the inherits parameter in that function to TRUE ). The benefit of assign is that it allows you to specify more parameters (e.g. the environment), so I prefer to use assign over <<- in most cases.

Using <<- and assign(x, value, inherits=TRUE) means that "enclosing environments of the supplied environment are searched until the variable 'x' is encountered." In other words, it will keep going through the environments in order until it finds a variable with that name, and it will assign it to that. This can be within the scope of a function, or in the global environment.

In order to understand what these functions do, you need to also understand R environments (e.g. using search ).

I regularly use these functions when I'm running a large simulation and I want to save intermediate results. This allows you to create the object outside the scope of the given function or apply loop. That's very helpful, especially if you have any concern about a large loop ending unexpectedly (e.g. a database disconnection), in which case you could lose everything in the process. This would be equivalent to writing your results out to a database or file during a long running process, except that it's storing the results within the R environment instead.

My primary warning with this: be careful because you're now working with global variables, especially when using <<- . That means that you can end up with situations where a function is using an object value from the environment, when you expected it to be using one that was supplied as a parameter. This is one of the main things that functional programming tries to avoid (see side effects ). I avoid this problem by assigning my values to a unique variable names (using paste with a set or unique parameters) that are never used within the function, but just used for caching and in case I need to recover later on (or do some meta-analysis on the intermediate results).

• 4 Thanks Tal. I have a blog, although I don't really use it. I can never finish a post because I don't want to publish anything unless it's perfect, and I just don't have time for that... –  Shane Commented Apr 13, 2010 at 13:44
• 5 A wise man once said to me it is not important to be perfect - only out standing - which you are, and so will your posts be. Also - sometimes readers help improve the text with the comments (that's what happens with my blog). I hope one day you will reconsider :) –  Tal Galili Commented Apr 13, 2010 at 15:25

One place where I used <<- was in simple GUIs using tcl/tk. Some of the initial examples have it -- as you need to make a distinction between local and global variables for statefullness. See for example

which uses <<- . Otherwise I concur with Marek :) -- a Google search can help.

• Interesting, I somehow cannot find tkdensity in R 3.6.0. –  NelsonGon Commented Jun 26, 2019 at 16:22
• 1 The tcltk package ships with R: github.com/wch/r-source/blob/trunk/src/library/tcltk/demo/… –  Dirk is no longer here Commented Jun 26, 2019 at 16:30

On this subject I'd like to point out that the <<- operator will behave strangely when applied (incorrectly) within a for loop (there may be other cases too). Given the following code:

you might expect that the function would return the expected sum, 6, but instead it returns 0, with a global variable mySum being created and assigned the value 3. I can't fully explain what is going on here but certainly the body of a for loop is not a new scope 'level'. Instead, it seems that R looks outside of the fortest function, can't find a mySum variable to assign to, so creates one and assigns the value 1, the first time through the loop. On subsequent iterations, the RHS in the assignment must be referring to the (unchanged) inner mySum variable whereas the LHS refers to the global variable. Therefore each iteration overwrites the value of the global variable to that iteration's value of i , hence it has the value 3 on exit from the function.

Hope this helps someone - this stumped me for a couple of hours today! (BTW, just replace <<- with <- and the function works as expected).

• 4 in your example, the local mySum is never incremented but only the global mySum . Hence at each iteration of the for loop, the global mySum get the value 0 + i . You can follow this with debug(fortest) . –  ClementWalter Commented Oct 26, 2015 at 16:49
• It's got nothing to do with it being a for-loop; you're referencing two different scopes. Just use <- everywhere consistently within the function if you only want to update the local variable inside the function. –  smci Commented Apr 29, 2016 at 3:08
• Or use <<-- everywhere @smci. Though best to avoid globals. –  Union find Commented Dec 5, 2017 at 4:15
• As far as I understand, R is NOT scoped withing braces { }, which is different from many other languages. The scoping is within functions. So, <<- does not access the mySum outside of the for loop as you might expect; rather, it accesses mySum outside of the fortest function. In the first run, mySum did not exist outside of fortest , so it was created, initialized as zero, and then incremented. Each subsequent iteration of the for loop iterates the global mySum again. So, the mySum in fortest always stays as zero but a global mySum is created and incremented to 3. –  Tripartio Commented Jan 3 at 13:14

• 12 This is a good example of where not to use <<- . A for loop would be clearer in this case. –  hadley Commented Apr 13, 2010 at 14:15

The <<- operator can also be useful for Reference Classes when writing Reference Methods . For example:

I use it in order to change inside purrr::map() an object in the global environment.

Say I want to obtain a vector which is c(1,2,3,1,2,3,4,5), that is if there is a 1, let it 1, otherwise add 1 until the next 1.

• This tiny answer explains what brought me to this question--why <- often does not work in purrr::map and I have to use <<- . Now I get it: purrr::map does its work inside a function and there only function scope applies. So, super-assignment <<- is required to modify variables outside of the purrr::map internal function (the .f argument). –  Tripartio Commented Jan 3 at 13:18

Your Answer

Reminder: Answers generated by artificial intelligence tools are not allowed on Stack Overflow. Learn more

Sign up or log in

Post as a guest.

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy .

Not the answer you're looking for? Browse other questions tagged r scoping lexical-scope r-faq or ask your own question .

• The Overflow Blog
• The hidden cost of speed
• The creator of Jenkins discusses CI/CD and balancing business with open source
• Featured on Meta
• Announcing a change to the data-dump process
• Bringing clarity to status tag usage on meta sites
• What does a new user need in a homepage experience on Stack Overflow?
• Feedback requested: How do you use tag hover descriptions for curating and do...
• Staging Ground Reviewer Motivation

Hot Network Questions

• What does こんなところ refer to here
• Do you believe something to be the truth or do you know the truth?
• What is this phenomenon?
• How would you read this time change with the given note equivalence?
• What qualifies as a Cantor diagonal argument?
• CompizConfig not working with xubuntu 24.04
• Sum[] function not computing the sum
• Is this host and 'parasite' interaction feasible?
• What are the most common types of FOD (Foreign Object Debris)?
• Approximations for a Fibonacci-Like Sequence
• Flats on gravel with GP5000 - what am I doing wrong?
• How to make my latex code to be continuously showing my big table in the next pages
• Where is this railroad track as seen in Rocky II during the training montage?
• Python function to expand regex with ranges
• What is the resulting inititive order when a readied action triggers after a summoned monsters action but before the summoner?
• Multiplicity of the smallest non-zero Laplacian eigenvalue for tree graphs
• Why does the guardian who admits guilt pay more than when his guilt is established by witnesses?
• How long should a wooden construct burn (and continue to take damage) until it burns out (and stops doing damage)
• Where did they get facehuggers from?
• Which volcano is more hazardous? Mount Rainier or Mount Hood?
• Are fuel efficiency charts available for mainstream engines?
• What happens on a CAN bus when impedance is too low?
• Do US universities invite faculty applicants from outside the US for an interview?
• Background package relying on obsolete everypage package