{
  "_comment": "Design guidance: the PIM for Groups policy the program sets on every PRV group, by access (member or owner) and tier. Durations are ISO 8601. Member activation and eligibility follow Book 04, Appendix B's tiers (4 hours for T0, 8 for the rest; eligibility 90, 180, 180 and 365 days; approval for T0 and T1). Owner activation of one hour with approval follows the example in Learn's 'Plan a Privileged Identity Management deployment'. Learn's Graph overview caps PIM for Groups activation at eight hours, so nothing here may exceed PT8H. Every activation, member or owner, requires the authentication context c1 (Chapter 03's PIM-Activation-c1), as Book 04, Chapter 10 and Appendix B require for PIM role settings and PIM for Groups; the enablement rules ask for justification and, except read-only members, a ticket. Learn: create and enable c1's Conditional Access policy before PIM selects it, so -Apply needs -ActivationGateChecked.",
  "maxActivation": "PT8H",
  "member": {
    "T0": { "activationMaxDuration": "PT4H", "approvalRequired": true, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P90D", "activeMaxDuration": "P90D" },
    "T1": { "activationMaxDuration": "PT8H", "approvalRequired": true, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P180D", "activeMaxDuration": "P180D" },
    "T2": { "activationMaxDuration": "PT8H", "approvalRequired": false, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P180D", "activeMaxDuration": "P180D" },
    "RO": { "activationMaxDuration": "PT8H", "approvalRequired": false, "authenticationContext": "c1", "enabledRules": ["Justification"], "eligibilityMaxDuration": "P365D", "activeMaxDuration": "P365D" }
  },
  "owner": {
    "T0": { "activationMaxDuration": "PT1H", "approvalRequired": true, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P90D", "activeMaxDuration": "P90D" },
    "T1": { "activationMaxDuration": "PT1H", "approvalRequired": true, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P90D", "activeMaxDuration": "P90D" },
    "T2": { "activationMaxDuration": "PT1H", "approvalRequired": true, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P90D", "activeMaxDuration": "P90D" },
    "RO": { "activationMaxDuration": "PT1H", "approvalRequired": true, "authenticationContext": "c1", "enabledRules": ["Justification", "Ticketing"], "eligibilityMaxDuration": "P90D", "activeMaxDuration": "P90D" }
  }
}
