azurepowershellmicrosoft-graph-apipim

Graph Powershell adding a user to PIM for a privileged security group


I have seen several articles online, but I do not think it is for what I need. I am looking for a Graph cmdlet in Powershell to add a user to PIM for a privileged security group, like what is done in Entra below. This is from the security group's page in Entra:

On the page for the SG

After clicking Add Assignments

I found this documentation of possible cmdlets, but the naming of them is pretty confusing. Does anybody know which cmdlet is the one I need?

Thanks!


Solution

  • To add user to PIM for privileged security group via Microsoft Graph PowerShell, you can make use of below sample script:

    Connect-MgGraph -Scopes 'PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup'
    
    Import-Module Microsoft.Graph.Identity.Governance
    
    $currentUtcStartTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
    $expirationDateTime = (Get-Date).AddHours(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
    
    $params = @{
        accessId = "member"  # Set to 'member' for regular membership; use 'owner' for admin privileges
        principalId = "userId"  # User's Object ID
        groupId = "groupId"  # Replace with the Security Group's Object ID
        action = "AdminAssign"  
        scheduleInfo = @{
            startDateTime = [System.DateTime]::Parse($currentUtcStartTime)  # Set to current UTC date and time
            expiration = @{
                type = "AfterDateTime"  # Specify the expiration type
                endDateTime = [System.DateTime]::Parse($expirationDateTime)  # Set expiration to 2 hours from now
            }
        }
        justification = "Assign eligible request."  # Provide a justification for the assignment
    }
    
    New-MgIdentityGovernancePrivilegedAccessGroupEligibilityScheduleRequest -BodyParameter $params
    

    Response:

    enter image description here

    To confirm that, I checked the same in Portal where user is assigned to member role for PIM security group:

    enter image description here

    Reference:

    Create eligibilityScheduleRequest - Microsoft Graph v1.0