Set‐PIMEntraRolePolicy
Configure PIM policy (rules) of $rolename
🔷 Limit the maximum activation duration to 8h for role "testrole"
PS> Set-PIMEntraRolePolicy -tenantID $tenantID -rolename testrole -ActivationDuration "PT8H"🔷 Require activation approval and set John as an approver
PS> Set-PIMEntraRolePolicy -TenantID $tenantID -rolename "contributor" -Approvers @(@{"Id"="00b34bb3-8a6b-45ce-a7bb-c7f7fb400507";"Name"="John";"Type"="user"}) -ApprovalRequired $true| Parameter | description |
|---|---|
$TenantID |
Entra ID TenantID |
$rolename |
name of the roles to update |
$ActivationDuration |
Maximum activation duration (Duration ref https://en.wikipedia.org/wiki/ISO_8601#Durations) |
$ActivationRequirement |
Accepted values: "None" or one or more options from "Justification", "MultiFactorAuthentication", "Ticketing" ex -ActivationRequirement "justification","Ticketing" WARNING: options are CASE SENSITIVE! |
$ApprovalRequired |
Is approval required to activate a role? ($true/$false) |
$Approvers |
Array of approvers in the format: @(@{"Id"="XXXXXX";"Name"="John":"Type"="user/group"}, .... ) |
$MaximumEligibilityDuration |
Maximum Eligility Duration (ref https://en.wikipedia.org/wiki/ISO_8601#Durations) |
$AllowPermanentEligibility |
Allow permanent eligibility? ($true/$false) |
$MaximumActiveAssignmentDuration |
Maximum active assignment duration (# Duration )ref https://en.wikipedia.org/wiki/ISO_8601#Durations) |
$AllowPermanentActiveAssignment |
Allow permanent active assignement? ($true/$false) |
$Notification_EligibleAssignment_Alert |
Admin Notification when eligible role is assigned, rule 9 see Notification Format |
$Notification_EligibleAssignment_Assignee |
End-user notification when eligible role is assigned, rule 10 see Notification Format |
$Notification_EligibleAssignment_Approver |
Approver notification when eligible role is assigned, rule 11 see Notification Format |
$Notification_ActiveAssignment_Alert |
Admin Notification when an active role is assigned, rule 12 see Notification Format |
$Notification_ActiveAssignment_Assignee |
End user Notification when an active role is assigned, rule 13 see Notification Format |
$Notification_ActiveAssignment_Approver |
Approver Notification when an active role is assigned, rule 14see Notification Format |
$Notification_Activation_Alert |
Admin Notification when a role is activated, rule 15 see Notification Format |
$Notification_Activation_Assignee |
End user Notification when a role is activated, rule 16 see Notification Format |
$Notification_Activation_Approver |
Approvers Notification when a role is activated, rule 17 see Notification Format |
All Notifications parameters accept value with the following format:
Set-PIMAzureResourcePolicy -tenantID $tid -subscriptionId $sid -Notification_Activation_Alert @{"isDefaultRecipientEnabled"="true|false"; "notificationLevel"="All|Critical";"Recipients" = @("email1@domain.com","email2@domain.com")} 