AzurePIMEligibleRoles
Azure PIM Eligible Roles Discovery Module for M&A Discovery Suite
What it does
Discovers Entra ID (Azure AD) privileged role schedule instances via Graph: 1) roleEligibilityScheduleInstances -> Status=Eligible (JIT can-activate) 2) roleAssignmentScheduleInstances -> Status=Active (currently assigned / activated) This tenant often has permanent/active directory role assignments surfaced via the assignment-schedule API while true JIT eligibility is empty. Querying only eligibility yields honest-but-misleading EMPTY; both endpoints are required for M&A privileged-access inventory and match the discovered-view stats (eligibleRoles + activeRoles). Enriches with principal display names / types and role definition display names ($expand when available, fallback roleDefinitions + directoryObject lookup). Output: AzurePIMEligibleRoles.csv
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/azure-pim-eligible Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.