๐ก๏ธ EasyPIM
PowerShell automation for Azure Privileged Identity Management.
---
Bulk-harden role policies. Clone settings across roles. Export assignments. Detect configuration drift. Approve or deny requests. Deploy full PIM models from JSON.
**One PowerShell module covering Azure Resources, Entra ID Roles, and Security Groups** โ with cmdlets that do what the portal can't. Unified ARM and Graph APIs, 50+ commands, 4 Azure clouds.
> ๐ **Start here โ** The **[EasyPIM Adoption Hub](https://kayasax.github.io/EasyPIM/)** walks you from first install to enterprise-grade PIM governance in three stages.
## ๐ Quick Start
```powershell
Install-Module EasyPIM, EasyPIM.Orchestrator -Force
# Harden 3 Entra roles in one shot โ try that in the portal
Set-PIMEntraRolePolicy -TenantID $tenantId `
-RoleName "Global Administrator","Security Administrator","Exchange Administrator" `
-ActivationRequirement "Justification","Ticketing","MultiFactorAuthentication" `
-ActivationDuration "PT4H"
# Audit every eligible assignment across a subscription
Get-PIMAzureResourceEligibleAssignment -TenantID $tenantId -SubscriptionId $subId
# Deploy a full PIM model from JSON โ Entra + Azure + Groups in one run
Invoke-EasyPIMOrchestrator -TenantId $tenantId -ConfigurationPath "./pim-config.json"
```
---
## โจ Things The Portal Can't Do
| | |
|---|---|
| โก **Bulk-harden roles** | Set MFA + justification + ticketing on 30 roles in one command |
| ๐ **Clone role settings** | Copy a hardened policy to other roles/users โ no manual re-clicking |
| ๐ **Export & import** | Assignments to CSV, full configs to JSON โ audit-ready in seconds |
| ๐ **Detect policy drift** | Compare live state vs declared config, get a diff report |
| ๐ข **CI/CD governance** | GitHub Actions & Azure DevOps ([Event-Driven Demo](https://github.com/kayasax/EasyPIM-EventDriven-Governance)) |
| โ๏ธ **Multi-cloud** | Public, Government, China, Germany โ same cmdlets everywhere |
| ๐ **Unified ARM + Graph** | One module abstracts both APIs โ no context-switching |
---
## ๐ฆ Install
```powershell
Install-Module EasyPIM, EasyPIM.Orchestrator -Scope CurrentUser
```
| Requirement | Details |
|---|---|
| PowerShell | 5.1+ or 7.0+ |
| Modules | `Az.Accounts`, `Microsoft.Graph.Authentication` (auto-installed) |
| Azure Resources | `Owner` or `User Access Administrator` on the subscription |
| Entra ID / Groups | Graph permissions: `RoleManagement.ReadWrite.Directory`, `RoleManagementPolicy.ReadWrite.Directory`, and [others](https://github.com/kayasax/EasyPIM/wiki/Documentation) |
---
## ๐ Learn More
| | |
|---|---|
| **[๐ Adoption Hub](https://kayasax.github.io/EasyPIM/)** | **Three-stage journey: quick-starts, best practices, enterprise patterns** |
| [๐ Full Documentation](https://github.com/kayasax/EasyPIM/wiki/Documentation) | In-depth guides and API reference |
| [๐ฏ Use Cases & Examples](https://github.com/kayasax/EasyPIM/wiki/Use-Cases) | Real-world implementation scenarios |
| [๐ Orchestrator Guide](https://github.com/kayasax/EasyPIM/wiki/Invoke%E2%80%90EasyPIMOrchestrator-step%E2%80%90by%E2%80%90step-guide) | JSON-driven workflows step-by-step |
| [๐ Migration v1โv2](https://github.com/kayasax/EasyPIM/wiki/Module-Migration) | Upgrading from v1.x |
| [๐ Changelog](https://github.com/kayasax/EasyPIM/wiki/Changelog) | Version history |
---
## ๐ง Two Modules, One Platform
| Module | Purpose | Key Commands |
|---|---|---|
| **EasyPIM** (Core) | Direct PIM API management โ policies, assignments, approvals | `Get-PIM*`, `Set-PIM*`, `New-PIM*` |
| **EasyPIM.Orchestrator** | JSON workflows, drift detection, business rules, CI/CD | `Invoke-EasyPIMOrchestrator`, `Test-PIMPolicyDrift` |
Click to expand the full cmdlet list (50+)
### Azure Resource Roles
| Cmdlet | Description |
|---|---|
| `Get-PIMAzureResourcePolicy` | Get role policy settings |
| `Set-PIMAzureResourcePolicy` | Configure activation requirements, duration, approvers |
| `Get-PIMAzureResourceEligibleAssignment` | List eligible assignments |
| `New-PIMAzureResourceEligibleAssignment` | Create eligible assignment |
| `Remove-PIMAzureResourceEligibleAssignment` | Remove eligible assignment |
| `Get-PIMAzureResourceActiveAssignment` | List active assignments |
| `New-PIMAzureResourceActiveAssignment` | Create active assignment |
| `Remove-PIMAzureResourceActiveAssignment` | Remove active assignment |
### Entra ID Roles
| Cmdlet | Description |
|---|---|
| `Get-PIMEntraRolePolicy` | Get Entra role policy settings |
| `Set-PIMEntraRolePolicy` | Configure activation requirements, MFA, approvers |
| `Get-PIMEntraRoleEligibleAssignment` | List eligible assignments |
| `New-PIMEntraRoleEligibleAssignment` | Create eligible assignment |
| `Remove-PIMEntraRoleEligibleAssignment` | Remove eligible assignment |
| `Get-PIMEntraRoleActiveAssignment` | List active assignments |
| `New-PIMEntraRoleActiveAssignment` | Create active assignment |
| `Remove-PIMEntraRoleActiveAssignment` | Remove active assignment |
### Groups
| Cmdlet | Description |
|---|---|
| `Get-PIMGroupPolicy` | Get group PIM policy settings |
| `Set-PIMGroupPolicy` | Configure group activation requirements |
| `Get-PIMGroupEligibleAssignment` | List eligible group assignments |
| `New-PIMGroupEligibleAssignment` | Create eligible group assignment |
| `Remove-PIMGroupEligibleAssignment` | Remove eligible group assignment |
| `Get-PIMGroupActiveAssignment` | List active group assignments |
| `New-PIMGroupActiveAssignment` | Create active group assignment |
| `Remove-PIMGroupActiveAssignment` | Remove active group assignment |
### Operations & Utilities
| Cmdlet | Description |
|---|---|
| `Approve-PIMPendingRequest` | Approve pending activation requests |
| `Deny-PIMPendingRequest` | Deny pending activation requests |
| `Get-PIMReport` | PIM activity analytics and audit trails |
| `Backup-PIMConfiguration` | Full PIM state backup |
| `Restore-PIMConfiguration` | Restore from backup |
| `Copy-PIMRoleSettings` | Clone settings between roles |
| `Export-PIMAssignment` | Export assignments to CSV |
| `Import-PIMAssignment` | Import assignments from CSV |
### Orchestrator
| Cmdlet | Description |
|---|---|
| `Invoke-EasyPIMOrchestrator` | Deploy complete PIM configuration from JSON |
| `Test-PIMPolicyDrift` | Detect policy drift against declared state |
| `Test-PIMEndpointDiscovery` | Connectivity and permissions validation |
---
## ๐ Coverage
**3 PIM scopes**: Azure Resources (subscription, management group, resource group) ยท Entra ID Roles ยท Security Groups
**4 clouds**: Public ยท Government ยท China ยท Germany
---
## ๐ค Related Projects
| | |
|---|---|
| **[EasyTCM](https://github.com/kayasax/EasyTCM)** | Tenant Configuration Monitoring โ detect config drift across Entra, Exchange, Intune, Teams & Compliance |
| **[Event-Driven Governance](https://github.com/kayasax/EasyPIM-EventDriven-Governance)** | Production CI/CD demo: GitHub Actions + Azure DevOps + Event Grid |
---
## ๐ค Contributing
See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
### Contributors
- **[Loรฏc MICHEL](https://github.com/kayasax)** โ Author and maintainer
- **[AzureStackNerd](https://github.com/AzureStackNerd)** โ ABAC condition support for Azure Resource assignments, Graph scope optimization
- **[Chase Dafnis](https://github.com/CHDAFNI-MSFT)** โ Multi-cloud / Azure environment support
- **[jeenvan](https://github.com/jeevanions)** โ Orchestrator: array format & management group scope fixes
---
Built with โค๏ธ for the Azure Administrator Community
Also by the author: EasyTCM โ M365 tenant config drift detection