Fetch all azure resource PIM roles in full details

Use a combination of Azure RBAC and PIM PowerShell cmdlets to:

1. list all active permanent assignments on Azure resources at all scopes, and
2. convert them to eligible/time-bound while excluding service principals, service accounts, and break-glass accounts.

Below is a pattern based only on what is documented in the provided context.

1. Discover all PIM-based eligible and time‑bound assignments

Use the PIM schedule cmdlets to list all eligible and active time‑bound assignments per scope (management group, subscription, resource group, resource):

# Example: list eligible and time‑bound assignments at subscription scope
$subscriptionId = '<subscriptionId>'

# Eligible (permanent + time‑bound)
$eligible = Get-AzRoleEligibilitySchedule -Scope "/subscriptions/$subscriptionId"

# Active time‑bound
$activeTimeBound = Get-AzRoleAssignmentSchedule -Scope "/subscriptions/$subscriptionId" |
    Where-Object { $_.EndDateTime -ne $null }

$allPimAssignments = @($eligible + $activeTimeBound)

Repeat with the appropriate -Scope for:

• Management group: /providers/Microsoft.Management/managementGroups/<group_id>
• Resource group: /subscriptions/<subscriptionId>/resourceGroups/<rgName>
• Individual resource scopes as needed.

This pattern follows the documented example:

Get-AzRoleEligibilitySchedule -Scope /subscriptions/<subscriptionId>
Get-AzRoleAssignmentSchedule -Scope /subscriptions/<subscriptionId> | Where-Object {$_.EndDateTime -ne $null }

2. Export all PIM role assignments (including children) for audit

If using PIM for Azure resources, export all active and eligible assignments including child scopes from the Entra admin center:

1. Sign in to the Microsoft Entra admin center.
2. Go to ID Governance > Privileged Identity Management > Azure resources.
3. Select the management group or subscription.
4. Select Assignments.
5. Select Export > Export all members to get a CSV of all active and eligible assignments for that scope and all child resource groups/resources.

This CSV can be filtered to identify:

• Active permanent assignments (standard Azure RBAC without PIM).
• PIM eligible and time‑bound assignments.

3. List all Azure RBAC role assignments (active permanent)

Use Get-AzRoleAssignment to list all RBAC assignments (including inherited) at each scope:

# All assignments in current subscription
Get-AzRoleAssignment

# Subscription scope
Get-AzRoleAssignment -Scope "/subscriptions/$subscriptionId"

# Management group scope
Get-AzRoleAssignment -Scope "/providers/Microsoft.Management/managementGroups/<group_id>"

# Resource group scope
Get-AzRoleAssignment -ResourceGroupName '<resource_group_name>'

These results include active permanent assignments (standard RBAC) and any PIM-created active assignments that are currently in effect.

4. Identify accounts to convert vs. exclude

From the combined data (PIM schedules + RBAC assignments):

1. Filter out principals that must remain active:
   • Service principals.
   • Service accounts.
   • Break‑glass accounts.
2. The remaining user/group assignments that are:
   • Active permanent (RBAC), or
   • Active time‑bound (PIM),
   are the candidates to convert to eligible.

5. Convert eligible/time‑bound assignments to active permanent (if needed)

If the goal is to remove PIM usage and make assignments active permanent, the documented pattern is:

1. Export all eligible and time‑bound assignments.
2. Remove eligible assignments using New-AzRoleEligibilityScheduleRequest with AdminRemove.

Example:

$guid = New-Guid
New-AzRoleEligibilityScheduleRequest -Name $guid `
    -Scope <Scope> `
    -PrincipalId <PrincipalId> `
    -RoleDefinitionId <RoleDefinitionId> `
    -RequestType AdminRemove

3. Recreate the same assignments as active permanent using standard Azure RBAC role assignment creation (not shown in the context).

Important: Removing role assignments can cause disruptions; ensure the impact is understood before running these steps.

6. Update or remove existing PIM resource role assignments

For Azure resource roles managed by PIM:

1. Open Microsoft Entra Privileged Identity Management.
2. Select Azure resources.
3. Select the management group, subscription, resource group, or resource.
4. Under Manage, select Roles and then the specific role.
5. On Eligible roles or Active roles tabs, locate the assignment.
6. Update or remove the assignment as needed (for example, to adjust conditions or durations, or to remove active assignments and re‑assign as eligible).

This UI path is useful to validate or adjust specific assignments after bulk PowerShell work.

7. Plan which roles must be PIM‑managed

Use PIM deployment planning guidance to decide which roles must be converted to eligible:

• Minimize Owner and User Access Administrator assignments.
• Manage all Subscription Owner and User Access Administrator roles using PIM.
• Prioritize high‑risk subscriptions/resources for PIM.

This planning step ensures that after converting active permanent assignments to eligible, the right roles remain protected by PIM.

References:

• Eligible and time-bound role assignments in Azure RBAC
• View activity and audit history for Azure resource roles in Privileged Identity Management
• Assign Azure resource roles in Privileged Identity Management
• List Azure role assignments using Azure PowerShell
• Plan a Privileged Identity Management deployment
• What is Microsoft Entra Privileged Identity Management?