Compare Microsoft Learn workflows with EasyPIM shortcuts

Official Microsoft Learn path

Microsoft Learn describes building a request body that specifies the principal, role definition ID, scope, schedule, justification, and action before calling New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
$params = @{
    PrincipalId      = "<principalId>"
    RoleDefinitionId = "<roleDefinitionId>"
    Justification    = "Add eligible assignment"
    DirectoryScopeId = "/"
    Action           = "AdminAssign"
    ScheduleInfo     = @{
        StartDateTime = Get-Date
        Expiration    = @{
            Type     = "AfterDuration"
            Duration = "PT10H"
        }
    }
}
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params

Source: Assign Microsoft Entra roles in Privileged Identity Management using Microsoft Graph PowerShell.

Official Microsoft Learn path

Microsoft Learn shows administrators how to build the request payload by hand, swapping Action to AdminAssign so the assignment is created active without user interaction.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
$params = @{
    PrincipalId      = "<principalId>"
    RoleDefinitionId = "<roleDefinitionId>"
    Justification    = "Create active assignment"
    DirectoryScopeId = "/"
    Action           = "AdminAssign"
    ScheduleInfo     = @{
        StartDateTime = Get-Date
        Expiration    = @{
            Type     = "AfterDuration"
            Duration = "PT1H"
        }
    }
}
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $params

Source: Assign Microsoft Entra roles in Privileged Identity Management.

Official Microsoft Learn path

Microsoft Learn walks through listing policies, finding the assignment that maps a role to a policy, and then enumerating all rules with multiple Get-MgPolicy* calls.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
$policy = Get-MgPolicyRoleManagementPolicy `
    -Filter "scopeId eq '/' and scopeType eq 'DirectoryRole'" `
    | Where-Object { $_.DisplayName -eq "DirectoryRole" }
$policyId = $policy.Id
Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $policyId | Format-List

Source: Manage PIM policies in Microsoft Graph PowerShell.

Limitation: The official walkthrough stops at raw objects—administrators must stitch together policy metadata and build their own CSV or JSON export pipeline.

Official Microsoft Learn path

Microsoft Learn only documents creating, extending, or removing one assignment at a time. There is no built-in clone workflow—admins must enumerate each existing assignment and reissue New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest for the new user.

# List existing assignments for the source user
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance `
    -Filter "principalId eq '<sourcePrincipalId>'"

# Recreate each assignment manually
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest `
    -PrincipalId "<targetPrincipalId>" `
    -RoleDefinitionId "<roleDefinitionId>" `
    -Action "AdminAssign" `
    -Justification "Recreate eligibility"

Source: Assign Microsoft Entra roles in Privileged Identity Management using Microsoft Graph PowerShell.

Limitation: No Microsoft Learn sample automates the loop; administrators shoulder the scripting effort to replicate settings user-by-user.

Official Microsoft Learn path

The official guidance first resolves the policy assignment to learn the hidden policy ID, then instantiates multiple strongly-typed rules before calling Update-AzRoleManagementPolicy for each scope.

Connect-AzAccount
$scope = "/subscriptions/<subscriptionId>"
$roleDefinitionId = (Get-AzRoleDefinition -Name "Contributor").Id

# Microsoft Learn omits this lookup: find the policy GUID that backs the assignment
$assignment = Get-AzRoleManagementPolicyAssignment -Scope $scope |
    Where-Object { $_.RoleDefinitionId -eq $roleDefinitionId }
$policyId = $assignment.PolicyId

$enablementRule = [Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Models.Api20201001Preview.RoleManagementPolicyEnablementRule]@{
    enabledRules   = @('MultiFactorAuthentication', 'Justification')
    id             = 'Enablement_EndUser_Assignment'
    ruleType       = [Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Support.RoleManagementPolicyRuleType]::RoleManagementPolicyEnablementRule
    targetCaller   = 'EndUser'
    targetOperation = @('Activate')
    targetLevel    = 'Assignment'
}
$notificationRule = [Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Models.Api20201001Preview.RoleManagementPolicyNotificationRule]@{
    notificationType           = 'Email'
    recipientType              = 'Approver'
    notificationRecipients     = @('approver@contoso.com')
    isDefaultRecipientsEnabled = 'false'
    notificationLevel          = 'Critical'
    id                         = 'Notification_Approver_EndUser_Assignment'
    ruleType                   = [Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Support.RoleManagementPolicyRuleType]::RoleManagementPolicyNotificationRule
    targetCaller               = 'EndUser'
    targetOperation            = @('Activate')
    targetLevel                = 'Assignment'
}
# Additional rules (for approvals, ticketing, etc.) require more typed objects.
$rules = [Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Models.Api20201001Preview.IRoleManagementPolicyRule[]]@(
    $enablementRule,
    $notificationRule
)
Update-AzRoleManagementPolicy -Scope $scope -Name $policyId -Rule $rules

Source: Update-AzRoleManagementPolicy (Az.Resources).

Extra work: Requiring approvers means creating an additional RoleManagementPolicyApprovalRule plus nested stage objects that reference each approver’s object ID.

Limitation: Administrators must discover the policy GUID up front, keep track of role definition IDs, and author each RoleManagementPolicy* object manually for every subscription.