To achieve your goal, first, create Privileged Access Groups (PAGs) for the User Administrator role, assign eligible members (User1, User2) to these groups, and then configure separate PIM Role Settings for each: one with no approval (automatic activation) for User1, and another with a custom approval workflow requiring User3's approval for User2. You'll create two separate PIM Role Assignments for the User Administrator role, one linked to each PAG, managing member settings to define activation requirements.
Here's the step-by-step creation process:
1. Create Privileged Access Groups (PAGs)
2. Assign Users to Groups
3. Configure PIM Role Settings
Go to Identity Governance > Privileged Identity Management > Microsoft Entra roles > Roles, then select the User Administrator role.
For User (Auto Activation):
*-> Select Add assignments, choose the PIM-UserAdmin-Auto group, set Assignment type to Eligible, and click Next.
In Membership settings, select Edit. Set Activation settings to require MFA (recommended) but NO approval (or disable approval settings).
For User2 (Approval Required):
*-> Select Add assignments, choose the PIM-UserAdmin-Approval group, set Assignment type to Eligible, and click Next.
In Membership settings, select Edit. Set Activation settings to require MFA and enable Require approval, specifying User 3 as the delegated approver.
4. Activate PIM for the User Administrator Role
Reference:
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure