A water-lab admin required approval to activate Contributor at the subscription, then assigned Contributor at a child resource group where activation needed no approver. What explains that behavior?
Select an answer to reveal the explanation.
Short Explanation
PIM settings are sticky notes on each resource’s role card—not paint that drips from the subscription onto every resource group. Configure approval on the RG’s Contributor settings too if you want the same gate downstairs.
Full Explanation
Microsoft Entra PIM settings for Azure resource roles are scoped to a specific role on a specific resource. Configuring approval at subscription scope does not inherit to the same role at a child resource group. Owners or User Access Administrators on that resource can manage its PIM settings; Privileged Role Administrator is not required by default for Azure resource role settings.