PIM settings script #99024

Script for management group overview #97859
2026-02-27 18:52:18 +01:00 · 2024-04-18 09:00:04 +02:00
parent c91b0f0908
commit 5003d32cad
8 changed files with 378 additions and 4 deletions
--- a/Powershell/Tools/AzurePIM
+++ b/Powershell/Tools/AzurePIM
@@ -0,0 +1,95 @@
+
+function GetAllPolicies {
+
+    param (
+        [string] $scope
+    )
+
+    #https://learn.microsoft.com/en-us/rest/api/authorization/role-management-policies/list-for-scope?view=rest-authorization-2020-10-01&tabs=HTTP
+
+    $access_token = (Get-AzAccessToken -TenantId "e9792fd7-4044-47e7-a40d-3fba46f1cd09").Token
+
+    $url = "https://management.azure.com/$scope/providers/Microsoft.Authorization/roleManagementPolicies?api-version=2020-10-01"
+            
+    $head = @{ Authorization =" Bearer $access_token" }
+    $response = Invoke-RestMethod -Uri $url -Method GET -Headers $head
+
+    $response | ForEach-Object { 
+         $responseValue = $_.value
+         if ($responseValue.Length -gt 0) {
+             return $responseValue
+         }
+         else {
+              return ""
+         }
+      }
+}
+
+function UpdatePolicy {
+    param (
+        [string] $scope,
+        [string] $roleManagementPolicyName,
+        [string] $patchValue
+    )
+    #https://learn.microsoft.com/en-us/rest/api/authorization/role-management-policies/update?view=rest-authorization-2020-10-01&tabs=HTTP
+    
+    $access_token = (Get-AzAccessToken -TenantId "e9792fd7-4044-47e7-a40d-3fba46f1cd09").Token
+    $url = "https://management.azure.com/$scope/providers/Microsoft.Authorization/roleManagementPolicies/$($roleManagementPolicyName)?api-version=2020-10-01"
+    $head = @{ Authorization =" Bearer $access_token" }
+    Invoke-RestMethod -Uri $url -Method Patch -Headers $head -Body $patchValue -ContentType "application/json"  | Out-Null
+}
+
+Write-Host "=========================================================================================="
+Write-Host "Setting standard PIM role settings on modified roles."
+Write-Host "=========================================================================================="
+
+[string] $patchValue = Get-Content .\AzurePIMpatch.json -Raw 
+
+$managementGroups = Get-AzManagementGroup
+
+foreach ($managementGroup in $managementGroups) 
+{
+    Write-Host "--------------------------------------------------------------------"
+    Write-Host "Management group [$($managementGroup.Name)]"
+
+
+    $scope = "providers/Microsoft.Management/managementGroups/$($managementGroup.Name)"  
+    $assignments = GetAllPolicies -scope $scope | Where-Object { 
+        $prop = $_.properties
+        if ($prop.LastModifiedDateTime) { return $_ } 
+    }
+
+    foreach ($assignment in $assignments) 
+    {
+        $assignmentName = $assignment.name
+        Write-Host "Updating assignment [$($assignment.id)]"
+        UpdatePolicy -scope $scope -roleManagementPolicyName $assignmentName -patchValue $patchValue                                                
+    }
+
+    # $subscriptions = Get-AzManagementGroupSubscription -Group $managementGroup.Name | Where-Object State -eq "Active"
+
+    # foreach ($subscription in $subscriptions) 
+    # {
+    #     Write-Host "    --------------------------------------------------------------------"
+        
+    #     $scope = $subscription.Id.Substring($subscription.Parent.Length, $subscription.Id.Length - $subscription.Parent.Length)
+    #     $subscriptionId = $scope.Replace("/subscriptions/", "")
+    #     Write-Host "    Subscription [$($subscription.DisplayName) - $subscriptionId]"
+    #     Write-Host "    --------------------------------------------------------------------"
+
+    #     $assignments = GetAllPolicies -scope $scope | Where-Object { 
+    #                                                                     $prop = $_.properties
+    #                                                                     if ($prop.LastModifiedDateTime) { return $_ } 
+    #                                                                 }
+
+    #     foreach ($assignment in $assignments) 
+    #     {
+    #         $assignmentName = $assignment.name
+    #         Write-Host "        Updating assignment [$($assignment.id)]"
+    #         UpdatePolicy -scope $scope -roleManagementPolicyName $assignmentName -patchValue $patchValue                                                
+    #     }
+    # }
+}
+ Write-Host "=========================================================================================="
+ Write-Host "Done."
+