Entra ID PIM Eligible Roles
Entra ID privileged role schedule instances via Graph: 1) roleEligibilityScheduleInstances -> Status=Eligible 2) roleAssignmentScheduleInstances -> Status=Active This tenant often has permanent/active directory role...
What it does
Discovers Entra ID (Azure AD) privileged role schedule instances via Graph: 1) roleEligibilityScheduleInstances -> Status=Eligible (JIT can-activate) 2) roleAssignmentScheduleInstances -> Status=Active (currently assigned / activated) This tenant often has permanent/active directory role assignments surfaced via the assignment-schedule API while true JIT eligibility is empty. Querying only eligibility yields honest-but-misleading EMPTY; both endpoints are required for M&A privileged-access inventory and match the discovered-view stats (eligibleRoles + activeRoles). Enriches with principal display names / types and role definition display names ($expand when available, fallback roleDefinitions + directoryObject lookup). Output: AzurePIMEligibleRoles.csv
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/azure-pim-eligible Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.