Skip to content

Commit 54e99a5

Browse files
KoenZomersKoenZomers
authored
Merge pull request #4055 from KoenZomers/KoenZomers-AddPimCmdlets
Adding cmdlets which allow PIM activation
2 parents ba14cf9 + 70d8564 commit 54e99a5

18 files changed

+953
-3
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
1111
### Added
1212

1313
- Added `Reset-PnPDocumentID` cmdlet to request resetting the document ID for a document [#4238](https://github.com/pnp/powershell/pull/4238)
14+
- Added `Get-PnPPriviledgedIdentityManagementEligibleAssignment`, `Get-PnPPriviledgedIdentityManagementRole` and `Enable-PnPPriviledgedIdentityManagement` cmdlets to allow scripting of enabling Privileged Identity Management roles for a user [#4039](https://github.com/pnp/powershell/pull/4039)
1415

1516
### Changed
1617

@@ -92,6 +93,7 @@ Fixed app registration on Windows
9293
## [2.8.0]
9394

9495
### Added
96+
9597
- Added in depth verbose logging to all cmdlets which is revealed by adding `-Verbose` to the cmdlet execution [#4023](https://github.com/pnp/powershell/pull/4023)
9698
- Added `-CoreDefaultShareLinkScope` and `-CoreDefaultShareLinkRole` parameters to `Set-PnPTenant` cmdlet. [#4067](https://github.com/pnp/powershell/pull/4067)
9799
- Added `-Identity` parameter to the `Get-PnPFileSharingLink` cmdlet allowing for the retrieval of sharing links based on the file's unique identifier, file instance, listitem instance, or server relative path and supporting retrieval of sharing links for multiple files, such as all in a document library [#4093](https://github.com/pnp/powershell/pull/4093)
@@ -102,12 +104,14 @@ Fixed app registration on Windows
102104
- Added `-Folder` parameter to `Add-PnPDocumentSet` cmdlet to allow creation of document sets in a specific folder instead of the list root folder. [#4029](https://github.com/pnp/powershell/pull/4029)
103105

104106
### Fixed
107+
105108
- `Get-PnPTeamsChannel` and `Get-PnPTeamsPrimaryChannel` returning `unknownFutureValue` as MembershipType instead of `shared` [#4054](https://github.com/pnp/powershell/pull/4054)
106109
- Fixed using a AzureADUserPipeBind with `New-PnPAzureADUserTemporaryAccessPass`, `Get-PnPAvailableSensitivityLabel` and `Set-PnPSearchExternalItem` to not work when passing in the User ID GUID [#4123](https://github.com/pnp/powershell/pull/4123)
107110
- Fixed issue with `Get-PnPWebHeader` cmdlet not working properly in Group connected SharePoint sites. [#4147](https://github.com/pnp/powershell/pull/4147)
108111
- Fixed issue with `Get-PnPTeamsChannelFilesFolder` cmdlet to work properly for channels having data more than 2 GB. [#4127](https://github.com/pnp/powershell/pull/4127)
109112

110113
### Changed
114+
111115
- Fixed `Update-PnPTeamsUser` cmdlet to throw a better error message when after a user is removed from a Team but is still in the connected M365 group, for the few seconds that the 2 are out of sync. [#4068](https://github.com/pnp/powershell/pull/4068)
112116
- Changed `-FileUrl` on `Get-PnPFileSharingLink` to become obsolete. Please switch to using `-Identity` instead, passing in the same value [#4093](https://github.com/pnp/powershell/pull/4093)
113117

‎documentation/Enable-PnPPriviledgedIdentityManagement.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
---
2+
Module Name: PnP.PowerShell
3+
schema: 2.0.0
4+
applicable: SharePoint Online
5+
online version: https://pnp.github.io/powershell/cmdlets/Enable-PnPPriviledgedIdentityManagement.html
6+
external help file: PnP.PowerShell.dll-Help.xml
7+
title: Enable-PnPPriviledgedIdentityManagement
8+
---
9+
10+
# Enable-PnPPriviledgedIdentityManagement
11+
12+
## SYNOPSIS
13+
14+
**Required Permissions**
15+
16+
* Microsoft Graph: RoleAssignmentSchedule.ReadWrite.Directory
17+
18+
Temporarily enables a Privileged Identity Management role for a user
19+
20+
## SYNTAX
21+
22+
### By Role Name And Principal
23+
24+
```powershell
25+
Enable-PnPPriviledgedIdentityManagement -Role <PriviledgedIdentityManagementRolePipeBind> [-PrincipalId <Guid>] [-Justification <string>] [-StartAt <DateTime>] [-ExpireInHours <short>] [-Connection <PnPConnection>]
26+
```
27+
28+
### By Role Name And User
29+
30+
```powershell
31+
Enable-PnPPriviledgedIdentityManagement -Role <PriviledgedIdentityManagementRolePipeBind> -User <AzureADUserPipeBind> [-Justification <string>] [-StartAt <DateTime>] [-ExpireInHours <short>] [-Connection <PnPConnection>]
32+
```
33+
34+
### By Eligible Role Assignment
35+
36+
```powershell
37+
Enable-PnPPriviledgedIdentityManagement -EligibleAssignment <PriviledgedIdentityManagementRolePipeBind> [-Justification <string>] [-StartAt <DateTime>] [-ExpireInHours <short>] [-Connection <PnPConnection>]
38+
```
39+
40+
## DESCRIPTION
41+
Temporarily enables a Privileged Identity Management role for the provided allowing the user to perform actions that require the role. The role will be enabled starting at the specified date and time and will expire after the specified number of hours. The reason for the elevation of rights can be provided as justification.
42+
43+
## EXAMPLES
44+
45+
### Example 1
46+
```powershell
47+
Enable-PnPPriviledgedIdentityManagement -Role "Global Administrator"
48+
```
49+
50+
Enables the global administrator role for the current user through Privileged Identity Management starting immediately and expiring in 1 hour
51+
52+
### Example 2
53+
```powershell
54+
Enable-PnPPriviledgedIdentityManagement -Role "Global Administrator" -Justification "Just because"
55+
```
56+
57+
Enables the global administrator role for the current user through Privileged Identity Management starting immediately and expiring in 1 hour, adding the justification provided to be logged as the reason for the elevation of rights
58+
59+
### Example 3
60+
```powershell
61+
Enable-PnPPriviledgedIdentityManagement -Role "Global Administrator" -Justification "Just because" -StartAt (Get-Date).AddHours(2) -ExpireInHours 2
62+
```
63+
64+
Enables the global administrator role for the current user through Privileged Identity Management starting in 2 hours from now and expiring 2 hours thereafter, adding the justification provided to be logged as the reason for the elevation of rights
65+
66+
### Example 4
67+
```powershell
68+
Enable-PnPPriviledgedIdentityManagement -Role "Global Administrator" -User "someone@contoso.onmicrosoft.com"
69+
```
70+
71+
Enables the global administrator role for the provided user through Privileged Identity Management starting immediately and expiring in 1 hour
72+
73+
## PARAMETERS
74+
75+
### -Connection
76+
Optional connection to be used by the cmdlet.
77+
Retrieve the value for this parameter by either specifying -ReturnConnection on Connect-PnPOnline or by executing Get-PnPConnection.
78+
79+
```yaml
80+
Type: PnPConnection
81+
Parameter Sets: (All)
82+
Aliases:
83+
84+
Required: False
85+
Position: Named
86+
Default value: None
87+
Accept pipeline input: False
88+
Accept wildcard characters: False
89+
```
90+
91+
### -ExpireInHours
92+
Indication of after how many hours the elevation should expire. If omitted, the default value is 1 hour.
93+
94+
```yaml
95+
Type: short
96+
Parameter Sets: (All)
97+
Aliases:
98+
99+
Required: False
100+
Position: Named
101+
Default value: 1
102+
Accept pipeline input: False
103+
Accept wildcard characters: False
104+
```
105+
106+
### -Justification
107+
Text to be logged as the reason for the elevation of rights. If omitted, the default value is "Elevated by PnP PowerShell".
108+
109+
```yaml
110+
Type: string
111+
Parameter Sets: (All)
112+
Aliases:
113+
114+
Required: False
115+
Position: Named
116+
Default value: "Elevated by PnP PowerShell"
117+
Accept pipeline input: False
118+
Accept wildcard characters: False
119+
```
120+
121+
### -PrincipalId
122+
The Id of of the principal to elevate. If omitted, the default value is the current user, if the connection has been made using a delegated identity. With an application identity, this parameter is required.
123+
124+
```yaml
125+
Type: Guid
126+
Parameter Sets: By Role Name And Principal
127+
Aliases:
128+
129+
Required: False
130+
Position: Named
131+
Default value: None
132+
Accept pipeline input: False
133+
Accept wildcard characters: False
134+
```
135+
136+
### -Role
137+
The Id, name or instance of a role to elevate the current user to. Use `Get-PnPPriviledgedIdentityManagementRole` to retrieve the available roles.
138+
139+
```yaml
140+
Type: PriviledgedIdentityManagementRolePipeBind
141+
Parameter Sets: By Role Name And Principal, By Role Name And User
142+
Aliases:
143+
144+
Required: True
145+
Position: Named
146+
Default value: None
147+
Accept pipeline input: True
148+
Accept wildcard characters: False
149+
```
150+
151+
### -StartAt
152+
Date and time at which to start the elevation. If omitted, the default value is the current date and time, meaning the activation will happen immediately.
153+
154+
```yaml
155+
Type: DateTime
156+
Parameter Sets: (All)
157+
Aliases:
158+
159+
Required: False
160+
Position: Named
161+
Default value: Get-Date
162+
Accept pipeline input: False
163+
Accept wildcard characters: False
164+
```
165+
166+
### -User
167+
The Id, username or instance of a user which needs to be elevated
168+
169+
```yaml
170+
Type: AzureADUserPipeBind
171+
Parameter Sets: By Role Name And User
172+
Aliases:
173+
174+
Required: True
175+
Position: Named
176+
Default value: None
177+
Accept pipeline input: False
178+
Accept wildcard characters: False
179+
```
180+
181+
## RELATED LINKS
182+
183+
[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)

‎documentation/Get-PnPPriviledgedIdentityManagementEligibleAssignment.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
Module Name: PnP.PowerShell
3+
schema: 2.0.0
4+
applicable: SharePoint Online
5+
online version: https://pnp.github.io/powershell/cmdlets/Get-PnPPriviledgedIdentityManagementEligibleAssignment.html
6+
external help file: PnP.PowerShell.dll-Help.xml
7+
title: Get-PnPPriviledgedIdentityManagementEligibleAssignment
8+
---
9+
10+
# Get-PnPPriviledgedIdentityManagementEligibleAssignment
11+
12+
## SYNOPSIS
13+
14+
**Required Permissions**
15+
16+
* Microsoft Graph: RoleAssignmentSchedule.Read.Directory
17+
18+
Retrieve the available Privileged Identity Management eligibility assignment roles that exist within the tenant
19+
20+
## SYNTAX
21+
22+
```powershell
23+
Get-PnPPriviledgedIdentityManagementEligibleAssignment [-Identity <PriviledgedIdentityManagementRoleEligibilitySchedulePipeBind>] [-Connection <PnPConnection>]
24+
```
25+
26+
## DESCRIPTION
27+
Retrieve the available Privileged Identity Management eligibility assignment roles that exist within the tenant. These are the configured users with the configured roles they can be elevated to.
28+
29+
## EXAMPLES
30+
31+
### Example 1
32+
```powershell
33+
Get-PnPPriviledgedIdentityManagementEligibleAssignment
34+
```
35+
36+
Retrieves the available Privileged Identity Management eligibility assignment roles
37+
38+
### Example 2
39+
```powershell
40+
Get-PnPPriviledgedIdentityManagementEligibleAssignment -Identity 62e90394-69f5-4237-9190-012177145e10
41+
```
42+
43+
Retrieves the Privileged Identity Management eligibility assignment role with the provided id
44+
45+
## PARAMETERS
46+
47+
### -Connection
48+
Optional connection to be used by the cmdlet.
49+
Retrieve the value for this parameter by either specifying -ReturnConnection on Connect-PnPOnline or by executing Get-PnPConnection.
50+
51+
```yaml
52+
Type: PnPConnection
53+
Parameter Sets: (All)
54+
Aliases:
55+
56+
Required: False
57+
Position: Named
58+
Default value: None
59+
Accept pipeline input: False
60+
Accept wildcard characters: False
61+
```
62+
63+
### -Identity
64+
The name, id or instance of a Priviledged Identity Management eligibility assignment role to retrieve the details of
65+
66+
```yaml
67+
Type: PriviledgedIdentityManagementRoleEligibilitySchedulePipeBind
68+
Parameter Sets: (All)
69+
Aliases:
70+
71+
Required: False
72+
Position: Named
73+
Default value: True
74+
Accept pipeline input: True
75+
Accept wildcard characters: False
76+
```
77+
78+
## RELATED LINKS
79+
80+
[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)

‎documentation/Get-PnPPriviledgedIdentityManagementRole.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
Module Name: PnP.PowerShell
3+
schema: 2.0.0
4+
applicable: SharePoint Online
5+
online version: https://pnp.github.io/powershell/cmdlets/Get-PnPPriviledgedIdentityManagementRole.html
6+
external help file: PnP.PowerShell.dll-Help.xml
7+
title: Get-PnPPriviledgedIdentityManagementRole
8+
---
9+
10+
# Get-PnPPriviledgedIdentityManagementRole
11+
12+
## SYNOPSIS
13+
14+
**Required Permissions**
15+
16+
* Microsoft Graph: RoleManagement.Read.Directory
17+
18+
Retrieve the available Privileged Identity Management roles that exist within the tenant
19+
20+
## SYNTAX
21+
22+
```powershell
23+
Get-PnPPriviledgedIdentityManagementRole [-Identity <PriviledgedIdentityManagementRolePipeBind>] [-Connection <PnPConnection>]
24+
```
25+
26+
## DESCRIPTION
27+
Retrieve the available Privileged Identity Management roles that exist within the tenant. These are the roles to which elevation can take place.
28+
29+
## EXAMPLES
30+
31+
### Example 1
32+
```powershell
33+
Get-PnPPriviledgedIdentityManagementRole
34+
```
35+
36+
Retrieves the available Privileged Identity Management roles
37+
38+
### Example 2
39+
```powershell
40+
Get-PnPPriviledgedIdentityManagementRole -Identity "Global Administrator"
41+
```
42+
43+
Retrieves the Privileged Identity Management with the provided name
44+
45+
### Example 3
46+
```powershell
47+
Get-PnPPriviledgedIdentityManagementRole -Identity 62e90394-69f5-4237-9190-012177145e10
48+
```
49+
50+
Retrieves the Privileged Identity Management role with the provided id
51+
52+
## PARAMETERS
53+
54+
### -Connection
55+
Optional connection to be used by the cmdlet.
56+
Retrieve the value for this parameter by either specifying -ReturnConnection on Connect-PnPOnline or by executing Get-PnPConnection.
57+
58+
```yaml
59+
Type: PnPConnection
60+
Parameter Sets: (All)
61+
Aliases:
62+
63+
Required: False
64+
Position: Named
65+
Default value: None
66+
Accept pipeline input: False
67+
Accept wildcard characters: False
68+
```
69+
70+
### -Identity
71+
The name, id or instance of a Priviledged Identity Management role to retrieve the details of
72+
73+
```yaml
74+
Type: PriviledgedIdentityManagementRolePipeBind
75+
Parameter Sets: (All)
76+
Aliases:
77+
78+
Required: False
79+
Position: Named
80+
Default value: True
81+
Accept pipeline input: True
82+
Accept wildcard characters: False
83+
```
84+
85+
## RELATED LINKS
86+
87+
[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)

0 commit comments

Comments
 (0)