Welcome to EasyPIM Discussions!

[kayasax]

👋 Welcome!

Hey, I'm Loïc, currently working at Microsoft as a support engineer in the Azure identity team.
I noticed this is not easy to find where to start when you want to automate PIM management. After struggling with the API I thought I can share a script to demonstrate the API usage.
This script was transformed to a module and hosted on the PowerShell gallery for your convenience.
Feel free to suggest any improvement that could be added, and consider staring this project if you find it useful!

[Azure365Addict]

Great project!

I also wrote few automation scripts for PIM management on my own.

Here are the things you could consider to add:

• bulk assign/unassign roles (based on the input from file)
• bulk modify role settings (I often need to set the same settings for all roles within newly created subscription)
• copy roles from another user
• I also have a separate mechanism which checks if PIM users have P2 license assigned. Not sure if it needs to be added in your project.

[kayasax]

Hi @Azure365Addict, thank you for your interest in this module.
Your suggestions make sense, the good news is that you can already do this with EasyPIM :

1. I will not add this feature directly but you can simply pipe your objectID to a cmdlet like
   get-content c:\temp\users.txt |foreach{ new-pimentraroleeligibleAssignment -tenantID $tenantID -rolename "testrole" -principalID $_ }
2. The EasyPIM cmdlets support configuring muliple role at once, ex

set-pimazureResourcePolicy -tenantID $env:tenantID -subscriptionID $env:subscriptionId `
  -rolename "testrole","reader" `
  -Notification_Activation_Alert @{
     "isDefaultRecipientEnabled"="true";
     "notificationLevel"="All";
     "Recipients" = @("[email protected]","[email protected]")
}

You can also use the backup (for all roles) or export (for selected roles) cmdlets to create a csv file, update in excel and upload back your changes

3. You can configure a role as a template and apply the setting to others with copy-PIM* cmdlet, check https://github.com/kayasax/EasyPIM/wiki/Copy%E2%80%90PIMAzureResourcePolicy

4. This module is for now focusing on the administrative taks which does not require a license https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals#licenses-you-must-have-for-pim.

Thank you for the suggestions I hope you can achieve your tasks with the cmdlets already available, if something is missing or you have a scenario wich is not covered, please let me know!

[kayasax]

I misread 3), I see now you want to copy the role assignment from one user to others.
Yes this might be something I can check, but I believe a better way to do this is to assign the role to a group, then you add you users to this group... That being said there are some issues with some roles not working as expected when assigned from a group...
So I'll add this to the backlog :)

[Azure365Addict]

Thank you for the suggestions on points 1, 2 and 4. I will manage :)

When it comes to point 3, idea with groups is great but PIM can't be enabled for groups synchronized from on-premises environment so this is a no go in my case. This is the main reason why copying role assignments from one user to others would be useful. Especially, that we have a really diverse sets of roles + very often users request the same roles as user X.