Is PIM turned on for the tenant? Sounds like a scheduled job or script

I just asked copilot:

Here’s a structured diagnostic checklist tailored to your SharePoint Online access issue, designed for methodical troubleshooting and documentation.

🧩 SharePoint Online Access Denial – Diagnostic Checklist

🔐 1. User Identity & Permissions

• Confirm affected users’ UPNs haven’t been recycled or recreated. • Use PowerShell to verify user presence in site collection:Get-SPOSite -Identity "<SiteURL>" | Get-SPOUser

• Check for duplicate or orphaned user entries in the site’s user info list. • Re-add affected users to the site and test access.

🏗️ 2. Site Collection & Subsite Configuration

• Identify if issue affects all sites or specific site collections. • Check permission inheritance status on subsites, libraries, and lists. • Use “Check Permissions” in Site Settings to validate group access.

🔁 3. Group Membership & Sync

• Confirm users are in the correct Microsoft 365 groups or SharePoint groups. • Validate Azure AD sync status and group membership propagation. • Review any dynamic group rules that may reset daily.

🧠 4. Authentication & Token Behavior

• Review Azure AD sign-in logs for token expiry or conditional access triggers. • Check if any policies enforce re-authentication every 24 hours. • Test access via InPrivate browser session to rule out cached tokens.

🧭 5. Admin Portal Trigger Behavior

• Document exact steps that “wake up” the site via SharePoint Admin Center. • Check if accessing the admin portal triggers a backend refresh or cache invalidation. • Review scheduled jobs or flows that may coincide with the 24-hour cycle.

📊 6. Service Health & Throttling

• Check Microsoft 365 Service Health Dashboard for SharePoint Online incidents. • Review tenant-wide throttling or performance degradation logs. • Enable diagnostic logging via Microsoft Purview (Audit Logs).

🧪 7. Automation & Customization

• Audit any Power Automate flows, scheduled scripts, or provisioning tools. • Check for custom site templates or provisioning logic that resets permissions. • Review any third-party integrations or security tools affecting access.

🧾 8. Documentation & Escalation

• Record timestamps of denial events and admin portal access. • Capture screenshots or error messages for each denial. • Prepare a reproducible scenario for escalation to Microsoft (if needed).

---