Graph API support for Azure AD PIM Privileged access groups.

Question

Graph API support for Azure AD PIM Privileged access groups.

Backer, Faris 21

HI,

Is there any graph api support to create azure ad group with PIM enabled and edit setting for Privileged access groups?

Basicallly we are trying to automate creation of PIM enabled group and edit the setting of Privileged access groups.

Thanks

3 answers

Your answer

Answer 1

@Backer, Faris
Thank you for your post!

Using Graph APIs to create an Azure AD Groups with Privileged Identity Management (PIM) enabled, currently isn't supported. Additionally editing settings for Privileged access groups, is only supported through the Azure Portal. The PIM APIs are in public preview and with the current iteration now in beta, the PIM API consists of two categories: Azure AD roles and Azure resource roles: assignment, and activation API requests, and policy settings.

When it comes to the relationship between PIM entities and role assignment entities, the only link between the PIM entity and the role assignment entity for persistent (active) assignment for either Azure AD roles or Azure roles is the roleAssignmentScheduleInstance. There is a one-to-one mapping between the two entities. For more info.

If you'd like the ability to be able to create PIM enabled Azure AD groups and edit their settings using the Graph API, I'd recommend leveraging our User Voice forum and creating a feature request, so our engineering team can look into implementing this. I've also created an internal feature request, so our engineering team is aware of this as well.

Links:
Understand the Privileged Identity Management APIs
Bring privileged access groups (preview) into Privileged Identity Management
Configure privileged access group settings (preview) in Privileged Identity Management

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Backer, Faris 21 Reputation points

2022-02-07T06:42:10.297+00:00

You meant to say there is no way to create PIM access groups programatically. Currenttly it is only supported via console ?
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-02-07T22:20:39.757+00:00

@Backer, Faris
Thank you for following up on this, and I apologize for the confusion!

Yes. As of right now this is only support via the Azure Portal, but since the PIM API is in public preview, I'd continue monitoring the PIM API History documentation for the most up to date iteration releases.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
CarlZhao-MSFT 46,376 Reputation points

2022-02-25T07:11:08.323+00:00

Hi @Backer, Faris
Would you please provide us with an update on the status of your issue?
Backer, Faris 21 Reputation points

2022-02-25T07:15:43.417+00:00

@CarlZhao-MSFT

I have no update on this. I am actually waiting for microsoft to release this API.

Answer 2

CarlZhao-MSFT 46,376

Hi @Backer, Faris

According to your requirements, I suggest you open a support ticket.

Backer, Faris 21 Reputation points

2022-02-25T07:35:57.733+00:00

Its already there

https://feedback.azure.com/d365community/idea/643cf69b-e087-ec11-a81b-0022484bfd94
Backer, Faris 21 Reputation points

2022-02-25T07:39:49.983+00:00

Also, it been reported long time back in here too. When can we get an update on this ?
https://github.com/MicrosoftDocs/azure-docs/issues/70296
CarlZhao-MSFT 46,376 Reputation points

2022-02-25T08:00:16.89+00:00

I don't know exactly time, it's also related to the number of votes on your thread. According to your situation, I suggest you open a support ticket, and Microsoft will reply you by email within 1~3 working days.

Answer 3

Ketan Siddhapura 0

is this feature available now?

Using Graph API Create azure ad group with PIM enabled and edit setting for Privileged access groups?

Anonymous

@Ketan Siddhapura As far as I've been able to it is only able to be enabled through a call like this:

curl --fail -H 'Authorization: Bearer YOUR_TOKEN_HERE' -H 'Content-Type: application/json' -d '{ "externalId": "GROUP_ID_HERE" }' https://api.azrbac.mspim.azure.com/api/v2/privilegedAccess/aadGroups/resources/register

Then once you have that enabled you are able to edit rules on this endpoint, go lookup the documentation for each

https://graph.microsoft.com/v1.0/policies/roleManagementPolicies/${roleManagementPolicy}/rules/${ruleId}

finally if you want a group to be eligible to become a member of another group you can use the endpoint:

https://graph.microsoft.com/v1.0/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests

Daniel Orelius 20 Reputation points

2024-09-05T07:00:01.7166667+00:00

Hi @Anonymous

Where do you get your AccessToken, because when I use the one from "Get-AzAccessToken" it dosen't work.

Share via

Graph API support for Azure AD PIM Privileged access groups.

3 answers

Your answer