Entra-PIM

1.7.0

Simplify Microsoft Entra PIM role management with an interactive console experience. Features browser-based authentication with passkey/FIDO2 support, automatic step-up MFA handling, one-command activation/deactivation of eligible roles, and auto-installation of dependencies. Just run Start-EntraPIM - no app registration or complex configuration required.

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name Entra-PIM

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name Entra-PIM

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2025. All rights reserved.

Package Details

Author(s)

  • markorr321

Tags

Entra PIM Azure Identity Governance MicrosoftGraph Privileged RoleManagement

Functions

Start-EntraPIM

Dependencies

This module has no dependencies.

Release Notes

## 1.7.0
- Switched from WAM to browser-based authentication
- WAM was caching Windows PRT credentials and bypassing Conditional Access step-up requirements
- Browser auth with MSAL ensures fresh authentication and proper passkey/FIDO2 enforcement
- Step-up authentication now correctly prompts for hardware keys when required by CA policies

## 1.6.0
- Added step-up authentication support for PIM role activations
- Handles MFA/claims challenges automatically when activating privileged roles

## 1.5.0
- Added auto-installation of required modules (Az.Accounts, Microsoft.Graph)
- Script now automatically installs missing dependencies on first run

## 1.4.0
- Switched to WAM (Windows Account Manager) authentication for native SSO
- Removed app registration dependency - uses Microsoft public client ID
- Renamed script to Entra-PIM.ps1
- Code cleanup and optimizations

## 1.3.2
- Bug fixes

## 1.3.1
- Fixed project URLs in manifest

## 1.3.0
- Removed Microsoft.Graph.Users dependency
- Fixed module loading issues
- Improved error handling for module imports

## 1.2.0
- Performance optimizations
- Bug fixes

## 1.0.0
- Initial release
- Browser-based authentication with PKCE
- Role activation and deactivation workflows
- Interactive TUI for role selection
- Caching for optimized API calls

FileList

Version History

Version Downloads Last updated
1.7.0 (current version) 6 1/12/2026
1.6.2 19 12/30/2025
1.6.1 3 12/30/2025
1.6.0 6 12/29/2025
1.5.0 6 12/29/2025
1.4.0 5 12/29/2025
1.3.2 4 12/29/2025
1.3.1 6 12/27/2025
1.3.0 3 12/27/2025
1.2.0 6 12/27/2025
1.1.0 4 12/27/2025
1.0.0 4 12/27/2025
Show more