Expired Service Principal Credentials Leave PIM Role Active

Azure AD PIM and Expired Service Principal Credentials

When a service principal is granted an elevated role through Azure AD Privileged Identity Management (PIM), the role assignment can be activated within a defined window. The service principal’s password or certificate credential may be set to expire, yet PIM keeps the role assignment active once it has been granted. This creates a potential security gap: an expired credential can still be used to perform privileged actions if the role assignment remains active.

Current public documentation indicates that PIM does not automatically revoke the role assignment when the credential expires, and no API or policy setting forces such revocation. The behavior is consistent across tenants, though custom roles or conditional access policies may influence the outcome.

Key questions for investigation:

• Does Azure AD PIM support an automatic revocation mechanism for role assignments tied to expired service principal credentials?
• Is there a public API or policy that can enforce revocation or trigger alerts when a credential expires?
• Can conditional access or custom policies be leveraged to close the privilege window after credential expiration?