Powershell script to extract Azure PIM roles eligible and assigned roles/groups assignment

Question

Within Azure PIM, when I export assignment via the Azure PIM blade, using the export functionality I noticed that it is missing some roles and doesn't give the full picture, I am wondering if its possible to write a powershell script that will export out ALL assignments within PIM, eligible, permanent assignments, groups etc.

Answer 1

Hello @MrFlinstone,

In addition to Vasil Michev's response, you can also make use of below Microsoft Graph PowerShell script to export the Azure PIM roles eligible and assigned roles/groups assignment:

# Install-Module Microsoft.Graph.Identity.Governance

# Import-Module Microsoft.Graph.Identity.Governance

Connect-MgGraph -Scopes RoleManagement.Read.Directory, Directory.Read.All

$EligiblePIMRoles = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All -ExpandProperty *

$AssignedPIMRoles = Get-MgRoleManagementDirectoryRoleAssignmentSchedule -All -ExpandProperty *

$PIMRoles = $EligiblePIMRoles + $AssignedPIMRoles

$Report = [System.Collections.Generic.List[Object]]::new()

foreach ($a in $PIMRoles) {

    $regex = "^([^.]+)\.([^.]+)\.(.+)$"

    $a.Principal.AdditionalProperties.'@odata.type' -match $regex | out-null

    $obj = [pscustomobject][ordered]@{

        Assigned                 = $a.Principal.AdditionalProperties.displayName

        "Assigned Type"          = $matches[3]

        "Assigned Role"          = $a.RoleDefinition.DisplayName

        "Assigned Role Scope"    = $a.directoryScopeId

        "Assignment Type"        = (&{if ($a.AssignmentType -eq "Assigned") {"Active"} else {"Eligible"}})

        "Is Built In"            = $a.roleDefinition.isBuiltIn

        "Created Date"           = $a.CreatedDateTime

        "Expiration type"        = $a.ScheduleInfo.Expiration.type

        "Expiration Date"        = switch ($a.ScheduleInfo.Expiration.EndDateTime) {

            {$a.ScheduleInfo.Expiration.EndDateTime -match '20'} {$a.ScheduleInfo.Expiration.EndDateTime}

            {$a.ScheduleInfo.Expiration.EndDateTime -notmatch '20'} {"N/A"}

        }

    }

    $report.Add($obj)

}

$Report | Export-CSV -path C:\temp\AllPIMRolesExport.csv -NoTypeInformation

All the PIM roles exported successfully in the CSV like below:

Please do not forget to click  "Accept the answer” and  Yes  wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or still running into more issues, let me know in the  "comments"  and I would be happy to help you.

Answer 2

Please check out my module EasyPIM which includes a comprehensive set of commands for managing PIM across Entra, Azure and Groups! https://github.com/kayasax/EasyPIM

Example:

Answer 3

I have a sample script that does just that here: https://www.michev.info/blog/post/5958/reporting-on-entra-id-directory-role-assignments-including-pim