Azure PIM自动化PowerShell脚本问题排查及订阅级方案需求

1. PIM角色显示不一致问题修正 #

出现部分角色仅在组视图可见的核心原因是：脚本可能未通过PIM专属API创建合格分配，而是直接给组分配了永久角色，导致PIM界面无法识别为可激活的合格角色。修正要点：

• 必须使用PIM专属API创建合格分配，而非普通组角色分配
• 确保设置AssignmentState为Eligible，并配置激活规则

修正后的租户级PIM自动化脚本 #

# 连接Entra ID
Connect-AzureAD

# 1. 创建可分配Entra角色的组
$groupParams = @{
    DisplayName = "PIM-Attribute-Def-Admin-Group"
    Description = "Group eligible for Attribute Definition Administrator role via PIM"
    SecurityEnabled = $true
    MailEnabled = $false
    IsAssignableToRole = $true # 关键：启用角色分配权限
}
$roleGroup = New-AzureADMSGroup @groupParams

# 2. 获取目标租户级角色ID（Attribute Definition Administrator）
$targetRole = Get-AzureADMSPrivilegedRoleDefinition -ProviderId "aadRoles" | Where-Object { $_.DisplayName -eq "Attribute Definition Administrator" }

# 3. 为组创建PIM合格分配
$assignmentParams = @{
    ProviderId = "aadRoles"
    ResourceId = (Get-AzureADTenantDetail).ObjectId
    RoleDefinitionId = $targetRole.Id
    SubjectId = $roleGroup.Id
    AssignmentState = "Eligible" # 设置为合格状态，支持激活
    Schedule = @{
        Type = "Once"
        StartDateTime = (Get-Date).ToUniversalTime()
        EndDateTime = (Get-Date).AddYears(1).ToUniversalTime()
    }
}
New-AzureADMSPrivilegedRoleAssignment @assignmentParams

# 4. 配置激活规则（允许用户激活）
$settingParams = @{
    ProviderId = "aadRoles"
    ResourceId = (Get-AzureADTenantDetail).ObjectId
    RoleDefinitionId = $targetRole.Id
    Setting = @{
        "activationRules" = @{
            "mfaRequired" = $true
            "justificationRequired" = $true
            "maxActivationDuration" = "PT8H" # 最长激活8小时
        }
    }
}
Set-AzureADMSPrivilegedRoleSetting @settingParams

2. 订阅级PIM角色分配独立脚本 #

订阅级PIM需针对Azure资源特权访问配置，核心是指定订阅ID为资源ID，限制激活范围到目标订阅。

# 连接Azure资源管理器
Connect-AzAccount

# 1. 创建可分配Entra角色的组（仅用于订阅级角色分配）
$groupParams = @{
    DisplayName = "PIM-Subscription-Owner-Group"
    Description = "Group eligible for Subscription Owner role via PIM"
    SecurityEnabled = $true
    MailEnabled = $false
    IsAssignableToRole = $true
}
$subRoleGroup = New-AzureADMSGroup @groupParams

# 2. 获取目标订阅ID和角色ID（Owner）
$subscriptionId = "your-subscription-id"
$targetSubRole = Get-AzRoleDefinition -Name "Owner"

# 3. 为组创建订阅级PIM合格分配
New-AzRoleAssignment -SubscriptionId $subscriptionId `
    -RoleDefinitionName $targetSubRole.Name `
    -ObjectId $subRoleGroup.Id `
    -PrincipalType Group `
    -AssignableToRole $true

# 4. 启用PIM并设置激活规则
$pimParams = @{
    ResourceId = "/subscriptions/$subscriptionId"
    RoleDefinitionId = $targetSubRole.Id
    SubjectId = $subRoleGroup.Id
    AssignmentState = "Eligible"
    Schedule = @{
        StartDateTime = (Get-Date).ToUniversalTime()
        EndDateTime = (Get-Date).AddYears(1).ToUniversalTime()
        Type = "Once"
    }
}
New-AzPrivilegedRoleAssignment @pimParams

# 配置激活限制（仅允许订阅级激活）
Set-AzPrivilegedRoleSetting -ResourceId "/subscriptions/$subscriptionId" `
    -RoleDefinitionId $targetSubRole.Id `
    -Setting @{
        "activationRules" = @{
            "mfaRequired" = $true
            "justificationRequired" = $true
            "maxActivationDuration" = "PT4H"
            "allowedActivationScopes" = @("/subscriptions/$subscriptionId") # 限制激活范围为目标订阅
        }
    }

关键注意事项 #

• 运行脚本需具备Privileged Role Administrator或Global Administrator权限
• 组的IsAssignableToRole属性必须设为$true，否则无法分配到Entra/订阅级角色
• 若仍存在显示问题，可等待15-30分钟让PIM缓存同步，或手动刷新PIM界面

内容的提问来源于stack exchange，提问作者learner