services / Azure / PIM role eligibility schedule request

A Privileged Identity Management (PIM) role eligibility schedule request makes a principal eligible for an Azure RBAC role at a scope, creating a standing eligibility the principal can later activate (here, subject to approval).

Operates on RBAC/identity controls; eligibility for a privileged role is a tenant/subscription-wide privilege-escalation primitive.

Microsoft.​Authorization/​roleEligibilityScheduleRequests/​whenApprovalRequired/​write

Creating a role eligibility schedule request places a principal on the path to a (potentially privileged) RBAC role and establishes durable standing eligibility, even though final activation is approval-gated.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links