This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 53%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENS%3C/text%3E%3C/svg%3E)
I am trying to call the GraphAPI to get all eligible and active PIM roles for a user in our tenant. When I use the bellow call, I only get active assignments /graph.microsoft.com/beta/roleManagement/directory/transitiveRoleAssignments Is there a filter to use to get the eligible assignments as well?
That API endpoint does not cover PIM features, use the following instead: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-apis#design-of-current-api-iteration
@Vasil Michev will one of these list a user's eligible PIM roles?
Yes, it will. If you are looking for specific examples, I have a script that enumerates all roles (including eligible ones) here: https://www.michev.info/blog/post/3958/generate-a-report-of-azure-ad-role-assignments-via-the-graph-api-or-powershell