I built a PowerShell script that activates five or six Privileged Identity Management roles together instead of requiring each role to be activated manually. The remaining problem is determining the maximum activation duration for each role dynamically. Hardcoding the values in a CSV works for now, but the values may become inaccurate. I can retrieve role management policies with `Get-MgPolicyRoleManagementPolicy -Filter "scopeId eq '/' and scopeType eq 'DirectoryRole'"`, and I can retrieve role template IDs with `Get-MgDirectoryRole -All`, but I have not figured out how to match the policies to the corresponding roles or extract each role's maximum duration.
4 Answers
With Microsoft Graph PowerShell 2.37.0, you can map the values by starting with the current user's eligible role schedules. Expand `RoleDefinition`, use each `RoleDefinitionId` to locate its directory-role policy assignment, and then query the policy rule named `Expiration_EndUser_Assignment`. The value in `AdditionalProperties.maximumDuration` is the role's maximum activation duration. A simplified flow looks like this: `$context = Get-MgContext; $currentUser = (Get-MgUser -UserId $context.Account).Id; Get-MgRoleManagementDirectoryRoleEligibilitySchedule -ExpandProperty RoleDefinition -All -Filter "principalId eq '$currentUser'" | ForEach-Object { $roleId = $_.RoleDefinitionId; $policyId = (Get-MgPolicyRoleManagementPolicyAssignment -Filter "scopeId eq '/' and roleDefinitionId eq '$roleId' and scopeType eq 'DirectoryRole'").PolicyId; $rule = Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $policyId | Where-Object { $_.Id -like '*Expiration_EndUser_Assignment' }; $duration = $rule.AdditionalProperties.maximumDuration; Write-Host ("Role: " + $_.RoleDefinition.DisplayName + " - Duration: " + $duration) }`
Activating all of the roles together may seem close to activating a highly privileged administrator role, but using the narrowest required roles is generally safer. A broad administrator role would increase the potential impact if the account were compromised.
If these roles are always needed together, a PIM-enabled group with the required role assignments could be simpler than maintaining a custom activation script. That gives users one activation path while keeping the role configuration centralized.
The duration appears to be exposed through the Microsoft Graph PowerShell beta module. You can retrieve the policy rule whose ID ends with `Expiration_EndUser_Assignment`, then read `maximumDuration` from its additional properties. For example: `$rule = Get-MgBetaPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $policyId | Where-Object { $_.Id -like '*Expiration_EndUser_Assignment' }; $duration = $rule.AdditionalProperties.maximumDuration`. I have been hardcoding the values until this is available consistently in the standard module.
There is also a working approach in the current non-beta module: enumerate the signed-in user's eligible roles, find the policy assignment for each role definition, and then query the expiration rule.
That works when you control the role assignments, but in some organizations another team owns the roles or groups. In those cases, automation can still be useful for reducing the preparation time for routine tasks.