Get PIM (Privileged Identity Management) Eligible assignments from Graph API

Question

We would like to retrieve eligible assignments for the PIM groups we manage and store them in our database for reporting purposes. Could you please advise which permissions need to be selected in the Admin Consent Request within the Space tool and also provide the appropriate Microsoft Graph API endpoint for retrieving this information?

Answer 1

For PIM for Groups eligible assignments, use Microsoft Graph PIM for Groups APIs.

Permissions For reading eligible assignment requests, the least-privileged Microsoft Graph permission shown is:

• PrivilegedEligibilitySchedule.Read.AzureADGroup

If write operations are also required, the higher-privileged permission is:

• PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup

For delegated access with a work or school account, the signed-in user must also be an owner or member of the group, or hold a supported Microsoft Entra role. Supported built-in roles depend on whether the group is role-assignable:

• Role-assignable groups: Global Reader or Privileged Role Administrator
• Non-role-assignable groups: Global Reader, Directory Writer, Groups Administrator, Identity Governance Administrator, or User Administrator

The role assignments for the calling user must be scoped at the directory level.

Endpoint To query eligible membership or ownership requests for the current user:

GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/filterByCurrentUser(on='parameterValue')

More broadly, for PIM for Groups eligible assignments, the relevant API set is under eligibilityScheduleRequests. The documented operations include:

• Create eligibilityScheduleRequest
• List eligibilityScheduleRequests
• Get eligibilityScheduleRequest
• privilegedAccessGroupEligibilityScheduleRequest:cancel
• privilegedAccessGroupEligibilityScheduleRequest: filterByCurrentUser

If the requirement is to report on eligible assignments across managed PIM groups, the supported pattern in the provided material is to work with the PIM-enabled groups and query eligibility per group rather than expecting a direct API that returns all eligible groups for another user using only a user lookup.

---

• Govern membership and ownership of groups by using PIM for Groups
• privilegedAccessGroupEligibilityScheduleRequest: filterByCurrentUser
• Privileged Identity Management APIs
• Unable to get eligible groups for user accounts while using MgGraph powershell module - Microsoft Q&A