Getting a list of users whole PIM role assignments are about to expire

Question

I would like to know if its possible to get a list of users whose PIM directory role assignments are about to expire, usually an email gets sent with 14 days to go, but keen to understand if there is a powershell script that can be executed to show eligible role assignments that are about to expire

Answer 1

Hey there! You can absolutely pull back upcoming expirations via PowerShell. The easiest approach is to use the Microsoft Graph PowerShell SDK to enumerate eligible PIM assignments in your tenant and then filter on the end date. Here’s a quick script you can run:

# Install & connect

Install-Module Microsoft.Graph -Scope CurrentUser -Force

Import-Module Microsoft.Graph

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"

# Define window

$now       = (Get-Date).ToUniversalTime()

$threshold = $now.AddDays(14)

# Grab all eligible role assignments and filter for those ending in the next 14 days

$expiring = Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -All |

  Where-Object {

    $end = [datetime]$_.ScheduleInfo.EndDateTime

    $end -gt $now -and $end -le $threshold

  } |

  Select-Object `

    @{n='User';   e={$_.PrincipalDisplayName}},

    @{n='Role';   e={$_.RoleDefinitionId}},

    @{n='Expires';e={$_.ScheduleInfo.EndDateTime}}

# Output to screen (or export to CSV)

$expiring | Format-Table -AutoSize

# $expiring | Export-Csv expiring-pim-assignments.csv -NoTypeInformation

What this does:

1. Connects to Microsoft Graph with PIM read rights.
2. Pulls all eligible (time-bound) role assignments.
3. Filters where the EndDateTime is between now and 14 days out.
4. Shows you the user, the role definition ID, and the exact expiry timestamp.

If you’re managing Azure Resource roles via PIM (instead of directory roles), you can do something similar with the Az module:

Install-Module Az.Resources -Scope CurrentUser -Force

Connect-AzAccount

Get-AzRoleEligibilitySchedule -Scope /subscriptions/<yourSubId> |

  Where-Object {

    $_.EndDateTime -ne $null -and

    $_.EndDateTime -le (Get-Date).AddDays(14)

  } |

  Select-Object PrincipalName, RoleDefinitionName, EndDateTime

That will list all eligible RBAC assignments in the subscription that expire within the next 14 days.

Hope that gets you exactly the visibility you need!

References:

https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-renew-extend

https://learn.microsoft.com/azure/role-based-access-control/pim-integration