Automate Azure AD PIM Approval flow

MyAzQuery 166 Reputation points
2022-09-27T12:16:13.9+00:00

Is it possible to automate the Azure AD PIM approval flow ?

Do we have Azure REST API that can be invoked to automate the (1) approval and (2) request flows

Basically we want to automatically invoke this Azure AD PIM approval flow from ServiceNow

Please help

Microsoft Entra
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,436 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vukasin Terzic 341 Reputation points MVP
    2022-09-27T18:31:16.71+00:00

    Hello @MyAzQuery ,

    I believe this is possible via the API, but it is a two-step process, and I am not sure how this will affect the integration with ServiceNow.

    First, you need to retrieve the list of pending assignment requests. This will return a large list of requests that are not only active but also expired, etc, Here is the request with filter for requests with PendingApproval status: 

    GET https://graph.microsoft.com/beta/roleManagement/directory/roleAssignmentScheduleRequests?$filter=status eq 'PendingApproval'

    When you have your pending approval ID, you can then approve it with: 

    GET https://graph.microsoft.com/beta/roleManagement/directory/roleAssignmentApprovals/<approvalId>  

PATCH https://graph.microsoft.com/beta/roleManagement/directory/roleAssignmentApprovals/<approvalId>/steps/<stepId>  
{  
    "reviewResult": "Approve",  
    "justification": "<REASON>"  
}

    I hope this is good enough to start with. You can read more about the PIM API or approval process in this documentation:
    https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-apis

    Please let me know if you have any additional questions and please click on Accept as an answer in case this was helpful.