Review Entra ID PIM Privileged Roles with PowerShell
Find standing global admins, untouched eligible roles, and PIM gaps with a workflow that runs every month — not just before an audit.
Privileged Identity Management is the right answer for admin access in Entra ID. The problem is that most environments still have standing role assignments scattered around, plus eligible roles that nobody actually uses anymore.
A PowerShell workflow lets you turn the periodic 'who is global admin again?' question into a documented, repeatable review. PSForge has the building blocks ready.
What a good PIM review looks like
- List every active and eligible role assignment
- Highlight standing assignments that should be eligible-only
- Find eligible roles that have not been activated in months
- Confirm break-glass accounts are excluded by design
- Export the result in a format auditors will accept
Why this is a workflow, not a one-off
Privileged access changes constantly: new admins join, roles are added during an incident, contractors leave. A one-off review only proves the state on the day it ran.
Running this as a scheduled PSForge workflow means you always have a current snapshot — and a history of how it changed.
Example PIM privileged role review workflow
- Connect to Microsoft Graph with PrivilegedAccess scopes
- Export every active and eligible PIM role assignment
- Flag standing (active) assignments that should move to eligible
- List eligible roles never activated in the last 90 days
- Confirm break-glass accounts are present and excluded as expected
- Generate a privileged access review report
Final thoughts
PIM only delivers its value when someone is actually reviewing it.
A monthly PSForge workflow keeps that review honest, fast, and well-documented.