Step-by-Step Instructions
Complete Process Walkthrough
Click each step to expand the full instructions and understand why every stage is essential.
Phase 1 — Request & Approval
1
Email the Product Manager with Business Justification
User
▼
Send an email to the relevant Product Manager requesting temporary Entra ID role access. Your email must include:
• Role Required — the exact Entra ID directory role you need (e.g. User Administrator, Exchange Administrator)
• Duration — how long you need the role (e.g. 4 hours, 2 days, 1 week)
• User Account Details — the UPN or account the role should be assigned to
• Business Justification — a clear explanation of why the elevated access is needed
• Role Required — the exact Entra ID directory role you need (e.g. User Administrator, Exchange Administrator)
• Duration — how long you need the role (e.g. 4 hours, 2 days, 1 week)
• User Account Details — the UPN or account the role should be assigned to
• Business Justification — a clear explanation of why the elevated access is needed
💡 Why is this needed?
Entra ID roles grant powerful administrative privileges. Requiring written business justification ensures there is an auditable record of why elevated access was granted, who approved it, and for how long — this supports the principle of least privilege and satisfies internal security and compliance requirements.
2
Obtain Approval from the Product Manager
Manager
▼
Wait for the Product Manager to review and approve your request. The approval should be provided in writing (reply email) so it can be attached to the ServiceNow ticket in the next step.
💡 Why is this needed?
Managerial approval creates a segregation of duties — the person requesting access is not the same person authorising it. This prevents unauthorised privilege escalation and provides an approval chain that auditors can verify during security reviews.
3
Raise a ServiceNow "I Want Something" Request
User
▼
Navigate to the Digital Service Centre portal in ServiceNow. Select "I Want Something", then choose the Help / Enquiry category. Log a request detailing:
• The Entra ID role required
• The duration of the assignment
• The target user account
• Attach or reference the Product Manager's approval email
• The Entra ID role required
• The duration of the assignment
• The target user account
• Attach or reference the Product Manager's approval email
💡 Why is this needed?
The ServiceNow ticket creates a formal, trackable record in the IT Service Management system. It ensures the request enters the standard fulfilment workflow with SLA tracking, audit trails, and a reference number that links the approval to the technical implementation.
⚡ Tip
Include the exact role name as it appears in Entra ID (e.g. "Application Administrator") to avoid delays caused by ambiguity.
Phase 2 — ServiceDesk Implementation
4
Sign In with PRV Account & Elevate via PIM
Service Desk
▼
Access entra.microsoft.com using your PRV (privileged) account. Before making any changes, elevate your own privileges to "Privileged Role Administrator" through the PIM (Privileged Identity Management) approval process.
💡 Why is this needed?
PIM enforces just-in-time access for administrators. Even service desk engineers don't hold permanent admin rights — they must activate their role through PIM with time limits and approval. This dramatically reduces the attack surface from compromised admin accounts and ensures all privilege elevation is logged.
⚡ Tip
Always use your PRV account, never your standard user account, for administrative Entra ID operations.
5
Navigate to the Required Role in Roles & Admins
Service Desk
▼
Within the Entra admin centre, navigate to the "Roles & Admins" blade. Locate and click into the specific directory role that was requested (e.g. User Administrator, Groups Administrator).
💡 Why is this needed?
Entra ID has dozens of built-in directory roles, each with different permission scopes. Navigating to the correct role is essential — assigning the wrong role could grant either too much access (security risk) or insufficient access (failed request). Always verify the role name matches what was approved.
6
Add Assignment & Select the Member
Service Desk
▼
Click "Add Assignment" on the role page. In the panel that opens, click "No member selected" to open the member picker. Search for and select the requested user account, then click "Select" to confirm. Click "Next" to proceed to the assignment settings.
💡 Why is this needed?
The member selection step ensures the role is assigned to the exact account specified in the approved request. Double-check the UPN carefully — assigning a role to the wrong account is a security incident that may need to be reported.
7
Set as Eligible, Untick Permanently Eligible & Set Timeframe
Service Desk
▼
On the Assignment settings screen:
• Keep the assignment type set to "Eligible" (not Active)
• Untick "Permanently Eligible" — this is critical
• Set the start and end dates/times to match the approved duration
• Click "Assign" to complete the configuration
• Keep the assignment type set to "Eligible" (not Active)
• Untick "Permanently Eligible" — this is critical
• Set the start and end dates/times to match the approved duration
• Click "Assign" to complete the configuration
💡 Why is this needed?
Setting the role as "Eligible" rather than "Active" means the user still has to activate it through PIM each time they need it — adding another just-in-time control layer. Unticking "Permanently Eligible" and setting a time window ensures the eligibility automatically expires, preventing privilege creep where temporary access quietly becomes permanent.
⚠ Important
Never leave "Permanently Eligible" ticked for temporary role requests. This is the most common mistake and defeats the purpose of time-bound access.
8
Confirm Assignment & Notify the User
Service Desk
▼
Verify the user now appears in the role's eligible assignments list with the correct start and end dates. Update the ServiceNow ticket to confirm implementation, and notify the requesting user that their eligible role assignment is ready. The user can extend the assignment if required through a further request.
💡 Why is this needed?
Closing the loop with verification and notification ensures service quality — the user knows their access is ready, the ticket is properly resolved for SLA metrics, and the verification step catches any configuration errors before the user attempts activation. It also creates a complete audit trail from request through to fulfilment.