Azure Graph API - Approve PIM requests

Question

I'm trying to approve/deny requests for role activations using the new Azure AD Privileged Identity Management REST API.

I am already able to read all pending role activation requests using the following request:

GET https://graph.microsoft.com/beta/roleManagement/directory/roleAssignmentScheduleRequests

The response looks like this:

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignmentScheduleRequests",
    "value": [
        {
            "id": "40b1dff9-9703-4da8-bf8f-275141347b6e",
            "status": "PendingApproval",
            "createdDateTime": "2021-06-04T10:47:40.34Z",
            "completedDateTime": "2021-06-04T10:47:40.15Z",
            "approvalId": "40b1dff9-9703-4da8-bf8f-275141347b6e",
            "customData": null,
            "action": "SelfActivate",
            "principalId": "049bad91-8812-4daa-870e-1edf05f5ced1",
            "roleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
            "directoryScopeId": "/",
            "appScopeId": null,
            "isValidationOnly": false,
            "targetScheduleId": "40b1dff9-9703-4da8-bf8f-275141347b6e",
            "justification": "My custom reason",
            "createdBy": {
                "application": null,
                "device": null,
                "user": {
                    "displayName": null,
                    "id": "049bad91-8812-4daa-870e-1edf05f5ced1"
                }
            },
            "scheduleInfo": {
                "startDateTime": null,
                "recurrence": null,
                "expiration": {
                    "type": "afterDuration",
                    "endDateTime": null,
                    "duration": "PT8H"
                }
            },
            "ticketInfo": {
                "ticketNumber": "",
                "ticketSystem": ""
            }
        }
    ]
}

Which matches the request I can see in the Azure Portal:

Now I am trying to approve the above request using the PATCH operation by providing the returned id:

PATCH https://graph.microsoft.com/beta/roleManagement/directory/roleAssignmentScheduleRequests/40b1dff9-9703-4da8-bf8f-275141347b6e

For the payload, I tried adding Provisioned and Denied:

{
    "status": "Denied"
}

But for whatever reason, I keep getting the following Error (Code 404):

{
    "error": {
        "code": "UnknownError",
        "message": "{\"message\":\"No HTTP resource was found that matches the request URI 'https://api.azrbac.mspim.azure.com/api/v3/roleManagement/directory/roleAssignmentScheduleRequests('40b1dff9-9703-4da8-bf8f-275141347b6e')?'.\"}",
        "innerError": {
            "date": "2021-06-04T11:06:18",
            "request-id": "ec668ea0-cf33-4e41-bfb4-19ca4ac683ad",
            "client-request-id": "ca765884-79b1-7695-5c72-c5783dd9968c"
        }
    }
}

Any ideas?

user_1163423 · Answer

Finally, I was able to find a solution. Here is a complete sample using the PowerShell Graph SDK:

$scopes = @(
    "PrivilegedAccess.Read.AzureAD",
    "RoleAssignmentSchedule.ReadWrite.Directory", 
    "PrivilegedAccess.ReadWrite.AzureAD"    
)

Connect-MgGraph -Scopes $scopes

[array]$pendingApprovals = Invoke-GraphRequest `
    -Method GET `
    -Uri '/beta/roleManagement/directory/roleAssignmentScheduleRequests?$filter=(status eq ''PendingApproval'')' | 
Select-Object -ExpandProperty value

$approvalSteps = Invoke-GraphRequest `
    -Method GET `
    -Uri ('/beta/roleManagement/directory/roleAssignmentApprovals/{0}' -f $pendingApprovals[0].approvalId) | 
Select-Object -ExpandProperty steps | Where-Object status -eq InProgress

$body = @{
    reviewResult  = 'Approve'
    justification = 'Seems legit'
}

Invoke-GraphRequest `
    -Method PATCH `
    -Uri ('https://graph.microsoft.com/beta/roleManagement/directory/roleAssignmentApprovals/{0}/steps/{1}' -f $pendingApprovals[0].approvalId, $approvalSteps.id) `
    -Body $body

I also wrote a blog article about it: Approve requests for Azure AD roles in PIM

user_2344394 · Answer

You are on the right track using roleAssignmentScheduleRequests to get the pending request. Check out the response and in the value array there is an ID. Use that ID in the Update privilegedapproval call. (https://docs.microsoft.com/en-us/graph/api/privilegedapproval-update?view=graph-rest-beta&tabs=http)

PATCH /privilegedApproval/{id}

Example using the IDs you shared:

PATCH https://graph.microsoft.com/beta/privilegedApproval/40b1dff9-9703-4da8-bf8f-275141347b6e
Content-type: application/json
Content-length: 180

{
  "approvalState": "approved",
  "approverReason": "Martin Brandl approves you!"
}

In the request body for approval state your possible values are: pending, approved, denied, aborted, canceled.

Azure Graph API - Approve PIM requests

2 Answers