Read-only verification of eligible Azure roles when PIM returns AadPremiumLicenseRequired (400)

What authoritative, supported read-only method can determine whether a designated user has eligible Azure resource role assignments at, or inherited into, a resource-group scope when the PIM portal returns AadPremiumLicenseRequired (400)?

An IAM view showing no current active assignments does not answer the eligibility question. We currently classify eligible access as UNVERIFIED.

Please clarify:

Coverage of direct, inherited, and group-derived eligibility, including pagination.

Required permissions and licensing.

Whether eligibility can persist following license expiration or changes.

Whether the licensing error can establish absence of eligible assignments.

Please provide official documentation. We seek verification without activating roles, granting access, changing licensing or configuration, or inspecting application data. If no supported method exists under the current licensing, please state that limitation.