Should I permanently assign a role to a contractor?

No. A permanent role assignment is the thing people forget to remove after the work is done. Prefer PIM eligibility, which grants access only for an activated window, or a B2B guest invitation with an expiration, so access ends on its own.

What is Privileged Identity Management for?

PIM lets you grant just-in-time, time-boxed access to Azure and Entra roles. Instead of holding a role permanently, someone is made eligible and activates it when needed, for a limited window, with optional approval and an audit trail. It's the native way to avoid standing privileged access.

How do I revoke a contractor's Azure access?

With PIM, access ends when the activation window closes, so there's often nothing to revoke. To cut it sooner, remove their eligibility or deactivate the role. For a guest, remove the B2B account or let its access expiration lapse.

← All posts

July 15, 2026 · Nick Krykunov

How to give a contractor temporary Azure access (with PIM, not a standing role)

To give a contractor temporary Azure access, use Entra ID Privileged Identity Management. You make the contractor eligible for a role rather than permanently assigning it, and they activate it for a time-boxed window, optionally behind approval, so when the window ends the access is gone. A permanent role assignment is the common default, and it’s the one that gets left in place.

Why a permanent role assignment is the wrong default

Assigning a contractor a role directly is quick, so it’s what people reach for. The problem is that role assignments don’t clean themselves up. When the engagement ends, the assignment is still there, and unless someone remembers to remove it, the contractor keeps whatever access it granted. On Azure the leftover role assignments and service principal secrets are a real offboarding gap, and a permanent contractor role is one more of them.

The fix is to make the access time-boxed from the start, and Entra ID gives you a native way to do exactly that.

Privileged Identity Management

PIM is the Azure answer to standing access. Instead of assigning a role permanently, you make the contractor eligible for it. They activate the role when they need it, for a window you bound, and you can require approval before activation and get an audit trail of who activated what and when. When the window closes, the access ends on its own, with no assignment lingering.

That covers the privileged case cleanly. For a contractor who only needs scoped access to specific resources, you can still make a normal RBAC assignment, but pair it with a reminder or a review so it doesn’t become permanent by default.

Guest access for outside collaborators

If the contractor is external, invite them as a B2B guest in Entra ID and set an access expiration or an access review on the invitation. Their guest account, and the access tied to it, lapses at the point you set. It’s the right fit when the work is collaboration rather than deep privileged operations, and it keeps outside identities from sitting in your directory indefinitely.

The lighter path: access that expires

PIM and guest reviews get you there, but each one is a console workflow you repeat for every contractor. That’s why teams settle for the standing assignment they know they shouldn’t. Underneath both sits just-in-time access: a grant that opens for one task and closes itself, with no eligibility or review to build from scratch each time.

Where Korvalis fits

Drop a contractor into an unfamiliar subscription and a costly mistake is one mistyped command away. Korvalis handles both sides of that on Azure. It grants access that self-expires, so no standing assignment is left behind, and it watches the live session, stopping a destructive command before it lands, no matter who runs it: an engineer, a stolen token, a contractor, or an AI agent. It installs inside your own Azure subscription. When the work wraps up, offboarding an engineer from Azure covers the sessions and secrets people forget.

Frequently asked questions

How do I give a contractor temporary Azure access? Use PIM: make them eligible for a role, which they activate for a time-boxed window, so access ends on its own. For outside collaborators, a B2B guest invite with an expiration works.

Should I permanently assign a role? No. A permanent assignment is the thing people forget to remove. Prefer PIM eligibility or a guest invite with expiration.

What is PIM for? Just-in-time, time-boxed access to Azure and Entra roles, with optional approval and an audit trail, so nobody holds standing privileged access.

If temporary Azure access without a standing role sounds right, see how Korvalis does it or join the waitlist.