According to the documentation here it is possible to call Azure API's to configure PIM for Azure resources, I am trying to set this up at the subscription level, i.e contributor for a subscription.
I have the script as follows.
Connect-AzAccount
# Variables
$subscriptionId = "xxxxx" # Your subscription ID
$principalId = "xxxx" # User or group object ID
$roleDefinitionId = "b24988ac-6180-42a0-ab88-20f7382dd24c" # Contributor Role
$apiVersion = "2020-10-01-preview"
$requestId = (New-Guid).Guid # Unique ID for the roleEligibilityScheduleRequest
# Get current access token for Azure Resource Manager
$token = (Get-AzAccessToken -ResourceUrl "https://management.azure.com").Token
# Construct the request body
$body = @{
properties = @{
principalId = $principalId
roleDefinitionId = "/subscriptions/$subscriptionId/providers/Microsoft.Authorization/roleDefinitions/$roleDefinitionId"
requestType = "AdminAssign"
scheduleInfo = @{
startDateTime = (Get-Date).ToString("o") # ISO 8601 format
expiration = @{
type = "AfterDuration"
endDateTime = $null
duration = "P365D"
}
}
}
} | ConvertTo-Json -Depth 5
# API URL
$url = "https://management.azure.com/providers/Microsoft.Subscription/subscriptions/$subscriptionId/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/$($subscriptionId)?api-version=$apiVersion"
# Headers
$headers = @{
"Authorization" = "Bearer $token"
"Content-Type" = "application/json"
}
# Make the PUT request
$response = Invoke-RestMethod -Method Put -Uri $url -Headers $headers -Body $body
# Output response
$response
I get the error below.
Invoke-RestMethod : {"error":{"code":"SubjectNotFound","message":"The subject is not found."}}
At line:1 char:13
+ $response = Invoke-RestMethod -Method Put -Uri $url -Headers $headers ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand
Your subject, i.e. PrincipalId cannot be found. Make sure you are using the correct ID. In my scripts I use the following:
$principalId = Get-AzADUser -mail $userEmail | Select-Object -ExpandProperty Id
Also you are defining a requestId but it seems you are not using it.
You have:
$url = "https://management.azure.com/providers/Microsoft.Subscription/subscriptions/$subscriptionId/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/$($subscriptionId)?api-version=$apiVersion"
This works for me:
$url = "https://management.azure.com/subscriptions/$($subscriptionId)/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/$($requestId)?api-version=2020-10-01-preview"