Then i tried in aggregation settings, Directory roles filter. This works fine when i aggregate the roles. But when i assign any role to the user, it is by default assigned as “Active’ PIM role. But i want the roles to be assigned as ‘Eligible’ PIM roles.
Can someone please guide for both the issues and what is the better process to manage the PIM roles.
You might need to create a Azure PIM Provisioning Policy and have a Before Provisioning Rule to add the Eligible Roles.
Please check the documentation for more details
Below is the code you can use for Before Provisioning Rule.
// Iterate through each account request in the provisioning plan
for ( AccountRequest accountRequest : plan.getAccountRequests() ) {
// Go through each attribute request in the account request
if (plan.getAccountRequests() != null) {
for (AttributeRequest attrReq : accountRequest.getAttributeRequests()) {
String name = attrReq.getName();
String operation = attrReq.getOperation().toString();
// Check if attribute name is azureADEligibleRoles and operation is Add
if ("azureADEligibleRoles".equals(name) && "Add".equals(operation)) {
String duration = "permanent";
String justification = "testing duration";
Map attrs = new HashMap();
attrs.put("duration", duration);
attrs.put("justification", justification);
Attributes attributes = new Attributes();
attributes.putAll(attrs);
attrReq.setArguments(attributes);
}
}
}
} else {
log.debug("No account requests found in the provisioning plan.");
}
