Search code examples
azuremicrosoft-graph-api

Approve PIM request for Microsoft Entra Roles


I used New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest to activate a role assignment.
Now this request is pending for approval from another user. I want to automate this approval process.

enter image description here

I found these resources but I was unable to form a PS request. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-approval-workflow#approve-requests


Solution

  • I have one PIM request for Microsoft Entra role that is pending for approval like this:

    enter image description here

    To retrieve these details via PowerShell, you can run below MS Graph PowerShell command by signing in with Approver user and note Approval request ID:

    Connect-MgGraph -Scope "RoleAssignmentSchedule.ReadWrite.Directory","PrivilegedAccess.ReadWrite.AzureAD"
    Invoke-MgFilterRoleManagementDirectoryRoleAssignmentScheduleRequestByCurrentUser -Filter "status eq 'PendingApproval'"  -On "principal" | fl
    

    Response:

    enter image description here

    To approve this PIM request of Microsoft Entra role via PowerShell, I ran below script and got response like this:

    Connect-MgGraph -Scope "RoleAssignmentSchedule.ReadWrite.Directory","PrivilegedAccess.ReadWrite.AzureAD"
    
    $params = @{
        reviewResult = "Approve"
        justification = "Trusted User"
    }
    
    Update-MgBetaRoleManagementDirectoryRoleAssignmentApprovalStep -ApprovalId $approvalId -ApprovalStepId $approvalStepId -BodyParameter $params
    

    Response:

    enter image description here

    When I checked the same in Portal, role activated successfully as below:

    enter image description here