Azure PIM Provisioning Policy
Azure /Microsoft Entra ID Eligible/Active Roles
There is no requirement of addition/removal of the existing Create Profile (Provisioning Policy). However, while assigning/removing Azure /Microsoft Entra ID Eligible/Active Role assignment, additional request details can be provided through additional attributes such as the following:
|
Attribute |
Type |
Description |
Default |
|---|---|---|---|
|
duration |
String (ISO 8601 duration) |
Specifies the duration for which the role needs to be assigned to the user from the current time. For example, if a role needs to be assigned for six months, the duration should be provided as P180D. ISO 8601 duration format must be used. For example:
|
For Eligible Role: P365D For Active Role: P180D |
|
startDateTime |
Timestamp (ISO 8601, UTC) |
It specifies the start date and time from which the role needs to be assigned to the user. It is optional when duration is provided, but required when endDateTime is provided. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2021-11-19T09:40:27.91Z |
- |
|
endDateTime |
Timestamp (ISO 8601, UTC) |
It specifies the end date and time for role assignment of the user. startDateTime must be provided along with this attribute. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, 2022-11-19T09:40:27.91Z. |
- |
|
justification |
String |
It specifies the reason for the role assignment/removal operation. |
Admin Action for <user id> |
Azure PIM Active and Eligible Groups
The connector supports adding and removing PIM Active and Eligible group memberships. Additional request details can be provided through additional attributes such as the following:
|
Attribute |
Type |
Description |
Default |
|---|---|---|---|
|
duration |
String (ISO 8601) |
Schedule duration for the membership. Example: P30D (30 days). |
P365D (eligible) / P180D (active) |
|
justification |
String |
Business justification for the request. |
Admin Action for PIM group membership |
|
accessId |
String (member or owner) |
Whether the principal is assigned as a member or owner of the group. |
member |
Sample Provisioning Requests
{
"ProvisioningPlan": {
"AccountRequest": {
"AttributeRequest": [
{
"Value": {
"List": {
"String": [
"/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:c2f4ef07-c644-48eb-af81-4b1b4947fb11",
"/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4:a2138dac-4907-4679-a376-736901ed8ad8"
]
}
},
"Attributes": {
"Map": {
"entry": [
{
"key": "duration",
"value": "P10D"
},
{
"key": "justification",
"value": "Role Required to Manage Subscription"
}
]
}
},
"name": "azureActiveRoles",
"op": "Add"
},
{
"Value": {
"List": {
"String": [
"/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:5e467623-bb1f-42f4-a55d-6e525e11384b",
"/subscriptions/3XXXXXXX8-c792-1212-9b4a-8cXXXXXXX4/resourceGroups/DEV-ENV-RG:4f8fab4f-1852-4a58-a46a-8eaf358af14a"
],
"entry": {
"key": "justification",
"value": "Role Required to Manage Dev Resource Group"
}
}
},
"Attributes": {
"Map": {
"entry": [
{
"key": "startDateTime",
"value": "2021-11-19T09:40:27.91Z"
},
{
"key": "endDateTime",
"value": "2021-12-19T09:40:27.91Z"
}
]
}
},
"name": "azureEligibleRoles",
"op": "Add"
}
],
"application": "Azure PIM",
"nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX",
"op": "Modify"
},
"nativeIdentity": "8cb133a4-0cea-XXXX-8c02-XXXXXXXX"
}
}