EasyPIM
EasyPIM let you manage PIM Azure Resource, Entra Role and Groups settings and assignments with simplicity
Install / Use
/learn @kayasax/EasyPIMREADME
Bulk-harden role policies. Clone settings across roles. Export assignments. Detect configuration drift. Approve or deny requests. Deploy full PIM models from JSON.
One PowerShell module covering Azure Resources, Entra ID Roles, and Security Groups — with cmdlets that do what the portal can't. Unified ARM and Graph APIs, 50+ commands, 4 Azure clouds.
🌐 Start here → The EasyPIM Adoption Hub walks you from first install to enterprise-grade PIM governance in three stages.
🚀 Quick Start
Install-Module EasyPIM, EasyPIM.Orchestrator -Force
# Harden 3 Entra roles in one shot — try that in the portal
Set-PIMEntraRolePolicy -TenantID $tenantId `
-RoleName "Global Administrator","Security Administrator","Exchange Administrator" `
-ActivationRequirement "Justification","Ticketing","MultiFactorAuthentication" `
-ActivationDuration "PT4H"
# Audit every eligible assignment across a subscription
Get-PIMAzureResourceEligibleAssignment -TenantID $tenantId -SubscriptionId $subId
# Deploy a full PIM model from JSON — Entra + Azure + Groups in one run
Invoke-EasyPIMOrchestrator -TenantId $tenantId -ConfigurationPath "./pim-config.json"
✨ Things The Portal Can't Do
| | | |---|---| | ⚡ Bulk-harden roles | Set MFA + justification + ticketing on 30 roles in one command | | 🔄 Clone role settings | Copy a hardened policy to other roles/users — no manual re-clicking | | 📊 Export & import | Assignments to CSV, full configs to JSON — audit-ready in seconds | | 🔍 Detect policy drift | Compare live state vs declared config, get a diff report | | 🏢 CI/CD governance | GitHub Actions & Azure DevOps (Event-Driven Demo) | | ☁️ Multi-cloud | Public, Government, China, Germany — same cmdlets everywhere | | 🔗 Unified ARM + Graph | One module abstracts both APIs — no context-switching |
📦 Install
Install-Module EasyPIM, EasyPIM.Orchestrator -Scope CurrentUser
| Requirement | Details |
|---|---|
| PowerShell | 5.1+ or 7.0+ |
| Modules | Az.Accounts, Microsoft.Graph.Authentication (auto-installed) |
| Azure Resources | Owner or User Access Administrator on the subscription |
| Entra ID / Groups | Graph permissions: RoleManagement.ReadWrite.Directory, RoleManagementPolicy.ReadWrite.Directory, and others |
📖 Learn More
| | | |---|---| | 🌐 Adoption Hub | Three-stage journey: quick-starts, best practices, enterprise patterns | | 📋 Full Documentation | In-depth guides and API reference | | 🎯 Use Cases & Examples | Real-world implementation scenarios | | 🏗 Orchestrator Guide | JSON-driven workflows step-by-step | | 🔄 Migration v1→v2 | Upgrading from v1.x | | 📝 Changelog | Version history |
🔧 Two Modules, One Platform
| Module | Purpose | Key Commands |
|---|---|---|
| EasyPIM (Core) | Direct PIM API management — policies, assignments, approvals | Get-PIM*, Set-PIM*, New-PIM* |
| EasyPIM.Orchestrator | JSON workflows, drift detection, business rules, CI/CD | Invoke-EasyPIMOrchestrator, Test-PIMPolicyDrift |
Azure Resource Roles
| Cmdlet | Description |
|---|---|
| Get-PIMAzureResourcePolicy | Get role policy settings |
| Set-PIMAzureResourcePolicy | Configure activation requirements, duration, approvers |
| Get-PIMAzureResourceEligibleAssignment | List eligible assignments |
| New-PIMAzureResourceEligibleAssignment | Create eligible assignment |
| Remove-PIMAzureResourceEligibleAssignment | Remove eligible assignment |
| Get-PIMAzureResourceActiveAssignment | List active assignments |
| New-PIMAzureResourceActiveAssignment | Create active assignment |
| Remove-PIMAzureResourceActiveAssignment | Remove active assignment |
Entra ID Roles
| Cmdlet | Description |
|---|---|
| Get-PIMEntraRolePolicy | Get Entra role policy settings |
| Set-PIMEntraRolePolicy | Configure activation requirements, MFA, approvers |
| Get-PIMEntraRoleEligibleAssignment | List eligible assignments |
| New-PIMEntraRoleEligibleAssignment | Create eligible assignment |
| Remove-PIMEntraRoleEligibleAssignment | Remove eligible assignment |
| Get-PIMEntraRoleActiveAssignment | List active assignments |
| New-PIMEntraRoleActiveAssignment | Create active assignment |
| Remove-PIMEntraRoleActiveAssignment | Remove active assignment |
Groups
| Cmdlet | Description |
|---|---|
| Get-PIMGroupPolicy | Get group PIM policy settings |
| Set-PIMGroupPolicy | Configure group activation requirements |
| Get-PIMGroupEligibleAssignment | List eligible group assignments |
| New-PIMGroupEligibleAssignment | Create eligible group assignment |
| Remove-PIMGroupEligibleAssignment | Remove eligible group assignment |
| Get-PIMGroupActiveAssignment | List active group assignments |
| New-PIMGroupActiveAssignment | Create active group assignment |
| Remove-PIMGroupActiveAssignment | Remove active group assignment |
Operations & Utilities
| Cmdlet | Description |
|---|---|
| Approve-PIMPendingRequest | Approve pending activation requests |
| Deny-PIMPendingRequest | Deny pending activation requests |
| Get-PIMReport | PIM activity analytics and audit trails |
| Backup-PIMConfiguration | Full PIM state backup |
| Restore-PIMConfiguration | Restore from backup |
| Copy-PIMRoleSettings | Clone settings between roles |
| Export-PIMAssignment | Export assignments to CSV |
| Import-PIMAssignment | Import assignments from CSV |
Orchestrator
| Cmdlet | Description |
|---|---|
| Invoke-EasyPIMOrchestrator | Deploy complete PIM configuration from JSON |
| Test-PIMPolicyDrift | Detect policy drift against declared state |
| Test-PIMEndpointDiscovery | Connectivity and permissions validation |
🌐 Coverage
3 PIM scopes: Azure Resources (subscription, management group, resource group) · Entra ID Roles · Security Groups
4 clouds: Public · Government · China · Germany
🤝 Related Projects
| | | |---|---| | EasyTCM | Tenant Configuration Monitoring — detect config drift across Entra, Exchange, Intune, Teams & Compliance | | Event-Driven Governance | Production CI/CD demo: GitHub Actions + Azure DevOps + Event Grid |
🤝 Contributing
See CONTRIBUTING.md for guidelines.
Contributors
- Loïc MICHEL — Author and maintainer
- Chase Dafnis — Multi-cloud / Azure environment support
- jeenvan — Orchestrator: array format & management group scope fixes
<p align="center"> Built with ❤️ for the Azure Administrator Community<br> <strong>Also by the author: <a href="https://github.com/kayasax/EasyTCM">EasyTCM</a> — M365 tenant config drift detection</strong> </p>
