Skip to content

Commit 1f619b5

Browse files
kayasaxkayasax
committed
V1.7.1 add approval management for groups
1 parent 05f236e commit 1f619b5

4 files changed

+234
-1
lines changed

‎EasyPIM/EasyPIM.psd1

+4-1
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,10 @@ FunctionsToExport = @(
100100
'Deny-PIMAzureResourcePendingApproval',
101101
'Get-PIMEntraRolePendingApproval',
102102
'Approve-PIMEntraRolePendingApproval',
103-
'Deny-PIMEntraRolePendingApproval'
103+
'Deny-PIMEntraRolePendingApproval',
104+
'Get-PIMGroupPendingApproval',
105+
'Approve-PIMGroupPendingApproval',
106+
'Deny-PIMGroupPendingApproval'
104107
)
105108

106109
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.

‎EasyPIM/functions/Approve-PIMGroupPendingApproval.ps1

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<#
2+
.Synopsis
3+
EASYPIM
4+
Powershell module to manage PIM Azure Resource Role settings with simplicity in mind
5+
Get-PIMGroupPolicy will return the policy rules (like require MFA on activation) of the selected rolename at the subscription level
6+
Support querrying multi roles at once
7+
8+
.Description
9+
10+
Approve-PIMGroupPendingApprovall will use the Microsoft Graph APIs to retrieve the requests pending your approval
11+
12+
.PARAMETER approvalID
13+
approval ID from get-PIMAzureResourcePendingApproval
14+
15+
.PARAMETER justification
16+
justification for the approval
17+
18+
.Example
19+
PS> approve-PIMAzureResourcePendingApproval -approvalID $approvalID -justification "I approve this request"
20+
21+
Approve a pending request
22+
23+
.Link
24+
25+
.Notes
26+
Homepage: https://github.com/kayasax/easyPIM
27+
Author: MICHEL, Loic
28+
Changelog:
29+
Todo:
30+
* allow other scopes
31+
#>
32+
function Approve-PIMGroupPendingApproval {
33+
[CmdletBinding()]
34+
[OutputType([String])]
35+
param (
36+
37+
[Parameter(Position = 0, Mandatory = $true, ValueFromPipeline = $true,
38+
ValueFromPipelineByPropertyName = $true)]
39+
[System.String]
40+
# Approval ID
41+
$approvalID,
42+
43+
[Parameter(Position = 1, Mandatory = $true)]
44+
[System.String]
45+
# justification
46+
$justification
47+
48+
)
49+
process {
50+
try {
51+
#$script:tenantID = $tenantID
52+
53+
Write-Verbose "approve-PIMGroupPendingApproval start with parameters: approvalid => $approvalID, justification => $justification"
54+
55+
#Get the stages:
56+
#in groups stageID is the same as the approvalID
57+
58+
59+
#approve the request
60+
#https://learn.microsoft.com/en-us/graph/api/approvalstage-update?view=graph-rest-1.0&tabs=http
61+
62+
$body = '{"justification":"' + $justification + '","reviewResult":"Approve"}'
63+
Invoke-graph -endpoint "identityGovernance/privilegedAccess/group/assignmentApprovals/$approvalID/steps/$approvalID" -body $body -version "beta" -Method PATCH
64+
return "Success, request approved"
65+
66+
}
67+
catch {
68+
MyCatch $_
69+
}
70+
}
71+
}

‎EasyPIM/functions/Deny-PIMGroupPendingApproval.ps1

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<#
2+
.Synopsis
3+
EASYPIM
4+
Powershell module to manage PIM Azure Resource Role settings with simplicity in mind
5+
Get-PIMGroupPolicy will return the policy rules (like require MFA on activation) of the selected rolename at the subscription level
6+
Support querrying multi roles at once
7+
8+
.Description
9+
10+
Deny-PIMGroupPendingApprovall will use the Microsoft Graph APIs to retrieve the requests pending your approval
11+
12+
.PARAMETER approvalID
13+
approval ID from get-PIMAzureResourcePendingApproval
14+
15+
.PARAMETER justification
16+
justification for the approval
17+
18+
.Example
19+
PS> Deny-PIMAzureResourcePendingApproval -approvalID $approvalID -justification "I Deny this request"
20+
21+
Deny a pending request
22+
23+
.Link
24+
25+
.Notes
26+
Homepage: https://github.com/kayasax/easyPIM
27+
Author: MICHEL, Loic
28+
Changelog:
29+
Todo:
30+
* allow other scopes
31+
#>
32+
function Deny-PIMGroupPendingApproval {
33+
[CmdletBinding()]
34+
[OutputType([String])]
35+
param (
36+
37+
[Parameter(Position = 0, Mandatory = $true, ValueFromPipeline = $true,
38+
ValueFromPipelineByPropertyName = $true)]
39+
[System.String]
40+
# Approval ID
41+
$approvalID,
42+
43+
[Parameter(Position = 1, Mandatory = $true)]
44+
[System.String]
45+
# justification
46+
$justification
47+
48+
)
49+
process {
50+
try {
51+
#$script:tenantID = $tenantID
52+
53+
Write-Verbose "Deny-PIMGroupPendingApproval start with parameters: approvalid => $approvalID, justification => $justification"
54+
55+
#Get the stages:
56+
#in groups stageID is the same as the approvalID
57+
58+
59+
#Deny the request
60+
#https://learn.microsoft.com/en-us/graph/api/approvalstage-update?view=graph-rest-1.0&tabs=http
61+
62+
$body = '{"justification":"' + $justification + '","reviewResult":"Deny"}'
63+
Invoke-graph -endpoint "identityGovernance/privilegedAccess/group/assignmentApprovals/$approvalID/steps/$approvalID" -body $body -version "beta" -Method PATCH
64+
return "Success, request Denied"
65+
66+
}
67+
catch {
68+
MyCatch $_
69+
}
70+
}
71+
}

‎EasyPIM/functions/Get-PIMGroupPendingApproval.ps1

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<#
2+
.Synopsis
3+
EASYPIM
4+
Powershell module to manage PIM Azure Resource Role settings with simplicity in mind
5+
Get-PIMGroupPolicy will return the policy rules (like require MFA on activation) of the selected rolename at the subscription level
6+
Support querrying multi roles at once
7+
8+
.Description
9+
10+
Get-PIMGroupPendingApproval will use the Microsoft Graph APIs to retrieve the requests pending your approval
11+
12+
.PARAMETER tenantID
13+
Tenant ID
14+
15+
.Example
16+
PS> Get-PIMGroupPendingApproval -tenantID $tenantID
17+
18+
show pending request you can approve
19+
20+
.Link
21+
22+
.Notes
23+
Homepage: https://github.com/kayasax/easyPIM
24+
Author: MICHEL, Loic
25+
Changelog:
26+
Todo:
27+
* allow other scopes
28+
#>
29+
function Get-PIMGroupPendingApproval{
30+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseOutputTypeCorrectly", "")]
31+
[CmdletBinding()]
32+
param (
33+
34+
[Parameter(Position = 0, Mandatory = $true)]
35+
[System.String]
36+
# Tenant ID
37+
$tenantID
38+
39+
)
40+
try {
41+
$script:tenantID = $tenantID
42+
43+
Write-Verbose "Get-PIMAzureResourcePendingApproval start with parameters: tenantID => $tenantID"
44+
45+
$endpoint="identityGovernance/privilegedAccess/group/assignmentScheduleRequests/filterByCurrentUser(on='approver')?`$filter=status eq 'PendingApproval'"
46+
$response = Invoke-Graph -Endpoint $endpoint -Method "GET"
47+
48+
$out = @()
49+
50+
$pendingApproval = $response.value
51+
52+
if ($null -ne $pendingApproval) {
53+
$pendingApproval | ForEach-Object {
54+
$details=invoke-mgGraphRequest $("https://graph.microsoft.com/v1.0/identityGovernance/privilegedAccess/group/assignmentScheduleRequests/"+$_.id) -Method get
55+
#$details
56+
$principalDisplayName = invoke-mgGraphRequest $("https://graph.microsoft.com/v1.0/directoryobjects/"+$details.Principalid+"/") -Method get
57+
$groupDisplayName = invoke-mgGraphRequest $("https://graph.microsoft.com/v1.0/directoryobjects/"+$details.Groupid+"/") -Method get
58+
59+
60+
$request = @{
61+
"principalId" = $details.Principalid;
62+
"principalDisplayname" = $principalDisplayName.displayName;
63+
"groupId" = $details.groupId;
64+
"groupDisplayname" = $groupDisplayName.displayName;
65+
"role" = $details.AccessID;
66+
"status" = $details.status;
67+
"startDateTime" = $details.CreatedDateTime;
68+
"ticketInfo" = $details.ticketInfo;
69+
"justification" = $details.justification;
70+
"approvalId" = $details.approvalId;
71+
"createdOn" = $details.createdDateTime;
72+
}
73+
$o = New-Object -TypeName PSObject -Property $request
74+
$out += $o
75+
}
76+
}
77+
if ($out.length -eq 0) {
78+
#write-host "No pending approval"
79+
return $null
80+
}
81+
return $out
82+
83+
}
84+
catch {
85+
MyCatch $_
86+
}
87+
88+
}

0 commit comments

Comments
 (0)