Graph API v1.0 endpoint to retrieve eligible Azure AD group assignments for an admin user setup in PIM

Question

Hello,

I would like to know the Graph API v1.0 endpoint to retrieve eligible Azure AD group assignments for an admin user setup in Entra PIM.

I tried with the below beta endpoint in Postman tool. However I get 403 even with right API permission in Entra (PrivilegedAccess.Read.AzureADGroup.All) https://graph.microsoft.com/beta/privilegedAccess/aadGroups/roleAssignments?$expand=linkedEligibleRoleAssignment,subject,roleDefinition($expand=resource)&$filter=(assignmentState eq 'Eligible') and (subject/id eq '<subject id of an admin user>')

Two questions here:

1. I would like to productionise the API call and is there a v1.0 endpoint matching the above endpoint?
2. Is it possible to get the above beta endpoint working or is it just not possible because of the PIM restrictions?

(Or) Is there totally an alternate way to retrieve the eligible Azure AD group assignments instead of using the subject id of an user in the endpoint?

Answer 1

Wouldnt it be something like

https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilitySchedules?$filter=principalId eq 'UPN'