entra id pim activation stuck on pending approval

TL;DR

A PIM activation stuck in pending approval is almost always an approver problem: the listed approver left, the notification went to an unmonitored inbox, or the request expired while waiting. Find the pending request under Identity Governance > PIM, identify the named approvers, contact one directly, and then fix the role settings so there are multiple current approvers going forward.

Steps

1. In Entra admin go to Identity Governance > PIM and open the pending activation request. Note the listed approvers. Expected: one or more approvers are named. If the list is empty or points to someone who left the company, that is the stall.
2. Contact an approver directly by chat or phone, not just the email notification, which often lands in spam or an unmonitored inbox. Expected: the approver opens the pending request.
3. Check the request has not expired: activation requests have a configured maximum duration. Expected: the request is still inside its window. Expired requests need a fresh activation, not an approval.
4. If the designated approver is unavailable, have a PIM administrator approve the request or reassign it. Expected: the approval completes within minutes and the role activates.
5. Fix the root cause: update the PIM role settings to list current approvers, plural, never a single person, and confirm notification emails route to a monitored address. Expected: settings saved with two or more active approvers.

Use this when

• A role activation shows pending approval for hours with no decision
• The named approver is on leave or has left the company
• Approvers say they never received the notification

Not for this skill when

• Activation fails with an MFA or conditional access error (policy block, not approval)
• The user is not eligible for the role at all (assignment issue)
• You need emergency access right now (use the break-glass account per policy)

Compatibility

• Entra ID P2 (PIM requires P2)
• Applies to Entra roles and Azure resource roles

Variants

The approver says they never got the email

Check the notification settings on the PIM role. Notifications go to the role's configured contacts, and shared mailboxes need explicit configuration.

Approvals stall during off-hours

Keep an on-call approver in the list or set a shorter approval SLA for emergency-eligible roles.

Why it happens

PIM activation is a two-step dance: the eligible user requests, an approver approves. The request sits forever when the approver is wrong, gone, or never saw the notification. Single-approver configurations make this a certainty over time.

Edge cases

• Break-glass emergency accounts should be permanently active and exempt from approval workflows, per policy.
• Approval chains with external approvers: confirm they can reach the Entra admin portal at all.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_JR6prjXzWOjglYyWKbjplA