Omnicit.PIM.psd1
|
# # Module manifest for module 'Omnicit.PIM' # # Generated by: Omnicit # # Generated on: 2026-03-25 # @{ # Script module or binary module file associated with this manifest. RootModule = 'Omnicit.PIM.psm1' # Version number of this module. ModuleVersion = '0.7.0' # Supported PSEditions CompatiblePSEditions = @('Core') # ID used to uniquely identify this module GUID = 'ed16ca8d-c9c0-4987-90b9-749edc96ebb8' # Author of this module Author = 'Omnicit (originally by Justin Grote @justinwgrote)' # Company or vendor of this module CompanyName = 'Omnicit' # Copyright statement for this module Copyright = '(c) Omnicit. All rights reserved.' # Description of the functionality provided by this module Description = 'Entra ID Privileged Identity Management (PIM) Self Activation Commands for Directory Roles, Azure Resources, and Entra ID Groups' # Minimum version of the PowerShell engine required by this module PowerShellVersion = '7.4' # Name of the PowerShell host required by this module # PowerShellHostName = '' # Minimum version of the PowerShell host required by this module # PowerShellHostVersion = '' # Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only. # DotNetFrameworkVersion = '' # Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only. # ClrVersion = '' # Processor architecture (None, X86, Amd64) required by this module # ProcessorArchitecture = '' # Modules that must be imported into the global environment prior to importing this module RequiredModules = @( @{ ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '2.36.0' } @{ ModuleName = 'AzAuth'; ModuleVersion = '2.9.0' } ) # Assemblies that must be loaded prior to importing this module # RequiredAssemblies = @() # Script files (.ps1) that are run in the caller's environment prior to importing this module. # ScriptsToProcess = @() # Type files (.ps1xml) to be loaded when importing this module # Disabled: TypesToProcess re-registers type members on every Import-Module -Force but Remove-Module does NOT # clean type data, so the second test file import fails with "member is already present" errors. # Types are loaded via a single Update-TypeData -AppendPath call in the psm1 suffix instead. TypesToProcess = @() # Format files (.ps1xml) to be loaded when importing this module # Re-enabled: all format targets are Omnicit.PIM.* custom types (no Az-native type overrides), so # the AppendPath precedence issue with Az.Resources no longer applies. # The orphaned RoleAssignmentScheduleRequest override was removed because all Azure functions now # wrap output with Omnicit.PIM.AzureAssignmentScheduleRequest before returning. FormatsToProcess = @('Formats/Omnicit.PIM.Format.ps1xml') # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess # NestedModules = @() # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. FunctionsToExport = @('Connect-OPIM','Disable-OPIMAzureRole','Disable-OPIMDirectoryRole','Disable-OPIMEntraIDGroup','Disable-OPIMMyRole','Disconnect-OPIM','Enable-OPIMAzureRole','Enable-OPIMDirectoryRole','Enable-OPIMEntraIDGroup','Enable-OPIMMyRole','Get-OPIMAzureRole','Get-OPIMConfiguration','Get-OPIMDirectoryRole','Get-OPIMEntraIDGroup','Install-OPIMConfiguration','Remove-OPIMConfiguration','Set-OPIMConfiguration','Wait-OPIMDirectoryRole') # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. CmdletsToExport = @() # Variables to export from this module VariablesToExport = @() # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export. AliasesToExport = @('Connect-PIM','Disable-OPIMMyRoles','Disable-PIMADRole','Disable-PIMGroup','Disable-PIMResourceRole','Disable-PIMRole','Disconnect-PIM','Enable-OPIMMyRoles','Enable-PIMADRole','Enable-PIMGroup','Enable-PIMResourceRole','Enable-PIMRole','Get-PIMADRole','Get-PIMConfig','Get-PIMGroup','Get-PIMResourceRole','Get-PIMRole','pim','Remove-PIMConfig','unpim','Set-PIMConfig','Wait-PIMADRole','Wait-PIMRole') # DSC resources to export from this module DscResourcesToExport = @() # List of all modules packaged with this module # ModuleList = @() # List of all files packaged with this module # FileList = @() # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell. PrivateData = @{ PSData = @{ # Tags applied to this module. These help with module discovery in online galleries. Tags = @('PIM', 'Azure', 'EntraID', 'Identity', 'Privileged', 'Windows', 'MacOS', 'Linux') # A URL to the license for this module. LicenseUri = 'https://github.com/Omnicit/Omnicit.PIM/LICENSE' # A URL to the main website for this project. ProjectUri = 'https://github.com/Omnicit/Omnicit.PIM' # A URL to an icon representing this module. IconUri = 'https://raw.githubusercontent.com/Omnicit/Omnicit.PIM/main/assets/icon.png' # ReleaseNotes of this module ReleaseNotes = '## [0.7.0] - 2026-10-11 Azure roles (`Get-`, `Enable-` and `Disable-OPIMAzureRole`, and the Azure part of `pim` and `unpim`) now sign in with AzAuth and send their requests themselves. Installing the module brings AzAuth (2.9.0 or later) and Microsoft.Graph.Authentication instead of Az.Resources and Az.Accounts, importing it loads no Az module, and it now requires PowerShell 7.4 or later. A script that used an Az command only because this module brought it along must install and import that module itself. The Azure sign-in leaves your own Az context alone, and its token must be for the Graph session''s tenant and account, else `TenantMismatch` or the new `AccountMismatch`, and nothing is sent. Output keeps its property names, but Az''s .NET type names are gone: instead of `-is` against an Az type, test `$Obj.PSObject.TypeNames -contains ''Omnicit.PIM.AzureEligibilitySchedule''` (or another `Omnicit.PIM.Azure*` name). `Disconnect-OPIM` clears the module''s Azure token, not AzAuth''s own sign-in in the PowerShell process. `Connect-OPIM`, `pim` and `unpim` take `-Environment`: `Global` (the default, also for a Microsoft 365 GCC tenant), `USGov` (GCC High), `USGovDoD` or `China` (21Vianet), and every sign-in and request then goes to that cloud. A command for the session''s tenant keeps the session''s cloud, and naming another cloud signs in again. `Install-` and `Set-OPIMConfiguration -Environment` store a cloud other than `Global` on a tenant alias, which `-TenantAlias` then signs in to (`Global` when it stores none); a stored cloud the module does not know is refused before any sign-in. A 0.6.x module, like 0.7.0-preview0001 to 0003, ignores the stored cloud: it signs in to the global cloud, where the tenant does not exist, so the sign-in fails, and when it changes the map it writes it back without the cloud of every alias, which this version then reads as `Global`. Only `Global` is verified live; the sovereign clouds are covered by unit tests only, and a China sign-in may need an application of the tenant''s own, which the module does not yet take. `pim` and `unpim` now pass on every refusal of the activations and deactivations they make, such as an activation the policy refuses for a missing justification: it is written as their own error and reaches `-ErrorVariable`, also under `-ErrorAction SilentlyContinue`. The seconds right after a change are handled too. An Azure activation refused with `RoleAssignmentExists` because an earlier assignment has just ended is sent again, as a new request, for up to a minute (or reported as already active); no other refusal starts that retry, and a role assigned to you permanently, refused the same way, is reported only when the minute is up. A group deactivation that Graph refuses with `RoleAssignmentDoesNotExist`, as it does when the group was deactivated moments before, is `ActiveRoleNotFound`. And `Get-OPIMAzureRole -Activated -Scope` reads at the root and keeps only that scope, so a new activation shows at once. Microsoft Graph requests now wait out throttling that outlasts the Graph SDK''s own retries, within the bounds Azure requests use: a 429, or a read''s 503 with `Retry-After`, is sent again after the wait the service names (or a short, growing one), at most two minutes each and five minutes per request, with at most ten retries; a change is sent again only after a 429, which comes before the service acts. Beyond those SDK retries, tab completion never waits out throttling and a `-Wait` poll never waits past `-TimeoutSeconds`; completing role and group names is fast for hundreds of them. Each GitHub release and its version tag now always point at the commit whose build was published. ' # Prerelease string of this module Prerelease = '' # Flag to indicate whether the module requires explicit user acceptance for install/update/save # RequireLicenseAcceptance = $false # External dependent modules of this module # ExternalModuleDependencies = @() } # End of PSData hashtable } # End of PrivateData hashtable # HelpInfo URI of this module # HelpInfoURI = '' # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. # DefaultCommandPrefix = '' } |