Self Activate a Privileged (PIM) Role Eligble Assignment

[JanVidarElven]

This sample shows how you can Self Activate (or Deactivate) a Privileged Role Eligble Assignment you haven been given in Azure AD Privileged Identity Management. This sample is using Microsoft Graph PowerShell SDK v1, and require that you Install the Microsoft Graph PowerShell SDK | Microsoft Learn

Import-Module Microsoft.Graph.Authentication
# Connect with required scopes
Connect-MgGraph -Scopes User.ReadBasic.All, RoleManagement.Read.Directory, RoleAssignmentSchedule.ReadWrite.Directory

# Privileged Role is in the Beta endpoint of Microsoft Graph
Select-MgProfile -Name "beta"

Import-Module Microsoft.Graph.Users
# Get Admin User
$adminUser = Get-MgUser -UserId "your-user-upn"

Import-Module Microsoft.Graph.DeviceManagement.Enrolment
# Get Role by DisplayName
$adminRoleDisplayName = "Azure AD Joined Device Local Administrator"
$adminRole = Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq '$adminRoleDisplayName'"

# Activation Parameters
$adminUserId = $adminUser.Id
$adminRoleId = $adminRole.Id
$justification = "<your-justification-reason-here...>"
$duration = "PT1H"

$params = @{
    "PrincipalId" = "$adminUserId"
    "RoleDefinitionId" = "$adminRoleId"
    "Justification" = "$justification"
    "DirectoryScopeId" = "/"
    "Action" = "SelfActivate"
    "ScheduleInfo" = @{
      "StartDateTime" = Get-Date
      "Expiration" = @{
         "Type" = "AfterDuration"
         "Duration" = "$duration"
         }
       }
      }

# Activate!
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $params |
    Format-List Id, Status, Action, AppScopeId, DirectoryScopeId, RoleDefinitionID, `
    IsValidationOnly, Justification, PrincipalId, CompletedDateTime, CreatedDateTime, TargetScheduleID


# It is a good security practice to deactivate when you are done!
$params = @{
    "PrincipalId" = "$adminUserId"
    "RoleDefinitionId" = "$adminRoleId"
    "Justification" = "Done for the day!"
    "DirectoryScopeId" = "/"
    "Action" = "SelfDeactivate"
    }
  
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $params |
    Format-List Id, Status, Action, AppScopeId, DirectoryScopeId, RoleDefinitionID, IsValidationOnly, `
    Justification, PrincipalId, CompletedDateTime, CreatedDateTime, TargetScheduleID

`

[SuryenduB]

Will it work with group based role assignments ?