I have seen several articles online, but I do not think it is for what I need. I am looking for a Graph cmdlet in Powershell to add a user to PIM for a privileged security group, like what is done in Entra below. This is from the security group's page in Entra:
I found this documentation of possible cmdlets, but the naming of them is pretty confusing. Does anybody know which cmdlet is the one I need?
Thanks!
To add user to PIM for privileged security group via Microsoft Graph PowerShell, you can make use of below sample script:
Connect-MgGraph -Scopes 'PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup'
Import-Module Microsoft.Graph.Identity.Governance
$currentUtcStartTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$expirationDateTime = (Get-Date).AddHours(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$params = @{
accessId = "member" # Set to 'member' for regular membership; use 'owner' for admin privileges
principalId = "userId" # User's Object ID
groupId = "groupId" # Replace with the Security Group's Object ID
action = "AdminAssign"
scheduleInfo = @{
startDateTime = [System.DateTime]::Parse($currentUtcStartTime) # Set to current UTC date and time
expiration = @{
type = "AfterDateTime" # Specify the expiration type
endDateTime = [System.DateTime]::Parse($expirationDateTime) # Set expiration to 2 hours from now
}
}
justification = "Assign eligible request." # Provide a justification for the assignment
}
New-MgIdentityGovernancePrivilegedAccessGroupEligibilityScheduleRequest -BodyParameter $params
Response:
To confirm that, I checked the same in Portal where user is assigned to member role for PIM security group:
Reference: