Azure PIM PowerShell Script

0
votes

On Azure Portal we can grant Contributor role to Subscription using PIM for limited period of time. Like 1 - 2 - 3 hours. Those are called eligible assignments.

Anyone has tried assigning eligible assignments using powershell ? As per my research -- AZureADPreview module is present.

(https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/powershell-for-azure-ad-roles )

But it is still under preview and doens't have full functionality.

1
azurepowershellazure-active-directory
please refer to this document it may help you - Sruthi J

1 Answers

0
votes

I think the functionality has already been mentioned in the doc, give a sample here to elaborate on the specific usage.

For example, you want to assign the Application Administrator role to a user, then the script should be:

Note: The -ResourceId parameter uses your AAD tenant id <tenant-id>.

$role = Get-AzureADMSPrivilegedRoleDefinition -ProviderId aadRoles -ResourceId "<tenant-id>" | Where-Object {$_.DisplayName -eq 'Application Administrator'}

$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule
$schedule.Type = "Once"
$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$schedule.endDateTime = "2021-07-25T20:49:11.770Z"
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId aadRoles -Schedule $schedule -ResourceId "<tenant-id>" -RoleDefinitionId $role.Id -SubjectId "<object-id of user or group>" -AssignmentState "Eligible" -Type "AdminAdd"

enter image description here

Check in the portal:

enter image description here