EasyPIM is the most comprehensive PowerShell automation platform for Microsoft Privileged Identity Management (PIM). With 50+ specialized cmdlets, EasyPIM transforms complex ARM and Graph API interactions into simple, reliable automation workflows for Azure Resources, Entra ID Roles, and Security Groups.

• ⚡ Comprehensive Coverage: Azure Resources, Entra ID Roles, and Security Groups in one platform
• 🔧 Production-Tested: 50+ cmdlets covering every PIM operation
• 📊 JSON Orchestration: Define complete PIM configurations declaratively
• 🔄 Multi-Cloud Support: Public, Government, China, Germany clouds
• 🏢 Enterprise Ready: Powers PIM governance at scale with business rules validation

💼 Enterprise Demo: See EasyPIM in production with our Event-Driven Governance showcase

• 🚀 Quick Start • 🎯 Key Features • 📦 Installation
• 🎯 Sample Usage • 📚 Documentation • 🔧 Troubleshooting
• 🆕 Latest Release • 📋 Requirements • 🤝 Contributors

# 1. Install both modules for complete functionality
Install-Module -Name EasyPIM, EasyPIM.Orchestrator -Force

# 2. Import and discover commands
Import-Module EasyPIM, EasyPIM.Orchestrator
Get-Command -Module EasyPIM*

# 3. Start with basic PIM operations
Get-PIMAzureResourcePolicy -TenantID $tenantID -SubscriptionId $subscriptionID -RoleName "reader"

# 4. Try JSON-driven orchestration
Invoke-EasyPIMOrchestrator -TenantId $tenantId -ConfigurationPath "./pim-config.json"

• 🏗 Module Separation: Clean separation between core PIM operations and orchestration workflows
• 🔧 ARM API Fixes: Resolves InvalidResourceType errors and improves reliability
• 🛡 Enhanced Validation: Proactive error detection with clear guidance and business rules
• 📏 Standardized Parameters: Consistent naming with backward compatibility aliases
• 🌍 Multi-Cloud Support: Azure Public, Government, China, Germany clouds

• Parameter assignee renamed to principalId (backward-compatible alias provided)
• Orchestration commands moved to separate EasyPIM.Orchestrator module

Migration Guide: step-by-step orchestrator setup

• ⚡ Bulk Operations: Edit multiple roles simultaneously with advanced filtering
• 🔄 Role Cloning: Copy settings and assignments between roles/users with validation
• 📊 CSV Integration: Export/import role configurations with data transformation
• 🛡 Backup & Restore: Complete PIM state backup with versioning support
• 📈 Activity Reporting: Comprehensive PIM activity analytics and audit trails
• ✅ Request Management: Approve/deny pending requests with workflow automation

• 🏗 JSON-Driven Workflows: Define complete PIM models (Entra, Azure RBAC, Groups) declaratively
• 📋 Policy Drift Detection: Continuous compliance monitoring with automated remediation
• 🛡 Business Rules Engine: Intelligent validation preventing misconfigurations
• 🏢 CI/CD Integration: Production-ready automation for GitHub Actions & Azure DevOps
• 📊 Enterprise Dashboards: Professional monitoring with real-time compliance metrics
• ⚡ Event-Driven Architecture: Instant responses to configuration changes via Event Grid

• ☁️ Multi-Cloud Support: Azure Public, Government, China, Germany environments
• 🛡 Zero-Trust Security: OIDC authentication, Key Vault integration, no stored secrets
• 📏 Standardized APIs: Consistent parameter naming with backward compatibility
• 🏢 Production Validated: Powers enterprise PIM governance at scale

# Install both modules with latest versions
Install-Module -Name EasyPIM, EasyPIM.Orchestrator -Force -Scope CurrentUser

# Verify installation
Get-Module -Name EasyPIM* -ListAvailable | Select-Object Name, Version

# Import modules and discover available commands
Import-Module EasyPIM, EasyPIM.Orchestrator
Get-Command -Module EasyPIM* | Measure-Object  # 50+ cmdlets available!

# Quick connectivity test
Connect-AzAccount  # Required for Azure Resource roles
Connect-MgGraph    # Required for Entra ID roles and groups

For enterprise CI/CD automation, explore our Event-Driven Governance Demo showcasing GitHub Actions & Azure DevOps integration.

Note: EasyPIM manages PIM Azure Resource settings at the subscription level by default. Use the scope parameter for Management Group, Resource Group, or Resource-level management.

# Get configuration of multiple Azure Resource roles
Get-PIMAzureResourcePolicy -TenantID $tenantID -SubscriptionId $subscriptionID -RoleName "reader","contributor","owner"

# Analyze Entra ID role configurations
Get-PIMEntraRolePolicy -TenantID $tenantID -RoleName "Global Administrator","Security Administrator"

# Require MFA, justification, and ticketing for critical Entra roles
Set-PIMEntraRolePolicy -TenantID $tenantID -RoleName "Global Administrator" `
    -ActivationRequirement "Justification","Ticketing","MultiFactorAuthentication" `
    -ActivationDuration "PT4H"

# Configure approval workflow for Azure resource roles
Set-PIMAzureResourcePolicy -TenantID $tenantID -SubscriptionId $subscriptionID `
    -RoleName "Owner","Contributor" `
    -Approvers @(@{"Id"="user-guid";"Name"="John Doe";"Type"="user"}) `
    -ApprovalRequired $true

# List all eligible assignments for audit
Get-PIMAzureResourceEligibleAssignment -TenantID $tenantID -SubscriptionId $subscriptionID

# Create time-limited active assignment
New-PIMEntraRoleActiveAssignment -TenantID $tenantID -RoleName "Security Reader" `
    -PrincipalId $userGuid -Duration "PT8H" -Justification "Security audit"

# Deploy complete PIM configuration from JSON
Invoke-EasyPIMOrchestrator -TenantId $tenantId -ConfigurationPath "./pim-config.json"

# Detect and report policy drift
Test-PIMPolicyDrift -TenantId $tenantId -ConfigurationPath "./pim-config.json" -ReportPath "./drift-report.json"

💡 More examples available in the documentation

• 📋 Complete Documentation - In-depth guides and API reference
• 🎯 Use Cases & Examples - Real-world implementation scenarios
• 📝 Changelog - Version history and release notes
• 🖼️ EasyPIM Gallery - Visual showcase of features and capabilities

• ⚡ Quick Start Tutorial - First steps with EasyPIM
• 🏗 Orchestrator Guide - JSON-driven workflows
• 🔄 Module Migration - Upgrading from v1.x to v2.x

• 🔧 Security Best Practices - Enterprise security guidelines
• 🎛️ Event-Driven Demo - Production CI/CD automation showcase
• 📊 Business Rules & Governance - Policy validation frameworks

These commands moved to EasyPIM.Orchestrator for better separation:

• Invoke-EasyPIMOrchestrator - JSON workflow execution
• Test-PIMPolicyDrift - Policy compliance monitoring
• Test-PIMEndpointDiscovery - Connectivity validation

Migration is seamless - legacy shims provide guidance and automatic forwarding where applicable.

# Enhanced Key Vault diagnostics
Get-EasyPIMConfiguration -Verbose

# Check module versions and compatibility
Get-Module -Name EasyPIM* -ListAvailable | Select-Object Name, Version, PowerShellVersion

# Test connectivity and permissions
Test-PIMEndpointDiscovery -TenantId $tenantId  # Available in EasyPIM.Orchestrator

• 🐛 Report Issues - Bug reports with templates
• 💬 Community Discussions - Q&A and feature requests
• 📧 Enterprise Support - Available for production deployments
• 🎯 CI/CD Issues - Event-driven governance demo problems

• Loïc MICHEL - Original author and maintainer
• Chase Dafnis - Multi-cloud / Azure environment support

• ⭐ Star this repository if EasyPIM helps you!
• 🐛 Report issues to help improve the platform
• 💡 Feature requests for new capabilities
• 🤝 Contributing - We welcome pull requests and contributions

• PowerShell: 5.1+ (Windows) or 7.0+ (Cross-platform)
• Modules: Az.Accounts, Microsoft.Graph.Authentication (auto-installed)
• Permissions: Azure subscription access + Graph API permissions (see below)

• Azure Subscription: Owner or User Access Administrator role
• Consent: Azure Resource Manager API access (automatic)

Administrator must grant these Microsoft Graph permissions:

• RoleManagementPolicy.ReadWrite.Directory
• RoleManagement.ReadWrite.Directory
• RoleManagementPolicy.ReadWrite.AzureADGroup
• PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup
• PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup
• PrivilegedAccess.ReadWrite.AzureADGroup

• ✅ Azure Public (default)
• ✅ Azure Government (AzureUSGovernment)
• ✅ Azure China (AzureChinaCloud)
• ✅ Azure Germany (AzureGermanCloud)

Thanks to Chase Dafnis for multi-cloud support!

This project is licensed under the MIT License - see the LICENSE file for details.

Built with ❤ for the Azure Administrator Community

⚡ Ready for advanced automation? Explore the Event-Driven Governance Demo for production CI/CD integration!"