Microsoft will retire the Microsoft Entra Privileged Identity Management (PIM) Iteration 2 beta APIs on October 28, 2026. Calls to /beta/privilegedAccess will stop returning data, potentially breaking privileged-access automation, reports, reviews, and activation workflows.
What architects need to know
- Effective date: October 28, 2026.
- Retired surface: Microsoft Graph beta PIM Iteration 2, including
/aadRolesand/azureResources. - Replacement: Iteration 3 GA APIs in Microsoft Graph for Entra roles and groups, and Azure Resource Manager for Azure resource roles.
- Failure mode: scripts can authenticate successfully yet receive no data or fail downstream processing.
This is more than a version change
Iteration 2 grouped PIM operations under Microsoft Graph beta. The current architecture separates providers by managed resource. Microsoft Entra roles and PIM for Groups use Microsoft Graph, while Azure resource roles use Azure Resource Manager APIs.
| Scenario | Iteration 2 | Iteration 3 |
|---|---|---|
| Microsoft Entra roles | Graph beta /privilegedAccess/aadRoles | GA Microsoft Graph unifiedRole* resources |
| Azure resource roles | Graph beta /privilegedAccess/azureResources | Azure Resource Manager PIM APIs |
| PIM for Groups | Legacy beta implementations | GA Microsoft Graph privilegedAccessGroup* resources |
You cannot migrate by replacing /beta with /v1.0. Resource types, permissions, request schemas, and—in the Azure RBAC case—the API control plane all change.
How to discover affected dependencies
- Search repositories, runbooks, and pipelines for
/beta/privilegedAccess,/aadRoles,/azureResources,governanceRoleAssignmentRequest, andgovernanceRoleSetting. - Review Azure Automation, Functions, Logic Apps, PowerShell, app registrations, and third-party governance products.
- Inspect service-principal sign-in logs for applications calling Microsoft Graph or Azure Resource Manager with privileged permissions.
- Classify each workflow: assignment reads, eligibility creation, activation, extension, renewal, cancellation, or policy management.
Recommended migration map
- For active or eligible Entra role assignments, use
unifiedRoleAssignmentScheduleRequestandunifiedRoleEligibilityScheduleRequest. - For Azure roles, use ARM
Role Assignment Schedule RequestsandRole Eligibility Schedule Requests. - For PIM for Groups, use
privilegedAccessGroupAssignmentScheduleRequestandprivilegedAccessGroupEligibilityScheduleRequest. - For approval, maximum activation duration, and notification rules, use
roleManagementPolicyandroleManagementPolicyAssignment.
For Azure Resource Manager, the automation identity needs sufficient rights at the managed scope. Microsoft states that managing Azure resource PIM generally requires at least Owner or User Access Administrator.
Validation plan
- Run Iteration 2 and Iteration 3 in parallel and compare counts, principals, role definitions, scopes, dates, and states.
- Test delegated and app-only permissions where applicable.
- Validate pagination, filters, error handling, and eventual consistency.
- Confirm activations and expirations appear correctly in the portal and audit records.
- Update dashboards, alerts, and runbooks before removing the old code.
Conclusion
The deadline is immediate. The main risk is not the Entra portal—it is the silent integrations that underpin privileged-access governance. Inventory the endpoints and migrate by provider: Graph for Entra roles and groups, ARM for Azure roles.
For a broader look at modern DevOps governance, read our guide to the Microsoft AZ-401 Agentic DevOps certification.