What it works with
Module: Microsoft.Graph.Authentication
Context: PowerShell 7 · Microsoft Graph · Microsoft Entra PIM
Compatibility: PowerShell 7 is the supported target for this Microsoft Graph Entra template.
POWERSHELL / MICROSOFT.GRAPH.AUTHENTICATION
ProAdvancedRead-onlylow
Export Entra PIM eligible and active role assignments
Exports Microsoft Entra PIM eligible and active directory-role schedule instances with principal, role, scope, assignment type and time-bound state in one CSV report.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Exports Microsoft Entra PIM eligible and active directory-role schedule instances with principal, role, scope, assignment type and time-bound state in one CSV report.
Requirements
- CSV output path - Example: C:\Temp\entra-report.csv
Environment
- Module: Microsoft.Graph.Authentication
- Permissions: RoleEligibilitySchedule.Read.Directory + RoleAssignmentSchedule.Read.Directory
- Output: CSV report
- Context: PowerShell 7 · Microsoft Graph
- Risk: Low
Review before you run Review the generated PowerShell and scope before running it.
OPS / WORKSPACE
Ready to generate
Configure Export Entra PIM eligible and active role assignments in the Builder, review the generated PowerShell and run it in your own environment.
Why use this template?
Use this report to compare eligible privileges with currently active or permanently assigned directory roles. Eligible and active schedule instances remain distinct, while principal and role identifiers stay available even when expanded display metadata is limited.
The template uses Microsoft.Graph.Authentication and requires RoleEligibilitySchedule.Read.Directory + RoleAssignmentSchedule.Read.Directory. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.
Review before running
Review the generated script before you run it. Confirm both delegated PIM read scopes are appropriate, protect the exported privileged-access inventory and test outside production first.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested values and review the module, permissions, output and risk.
- Generate the script, read it carefully, and test it outside production before use.
For Pro templates, only the configuration values needed by this template are sent to Opselith after license validation. The script source remains server-side until generation.
Generate Export Entra PIM eligible and active role assignments →OPS / SCRIPT DETAILS
Script details
Exports Microsoft Entra PIM eligible and active directory-role schedule instances with principal, role, scope, assignment type and time-bound state in one CSV report. Review these details before generating or running the script.
Permissions and impact
Permissions: RoleEligibilitySchedule.Read.Directory · RoleAssignmentSchedule.Read.Directory
Risk: Low
Execution impact: Read-only. The script reads Microsoft Entra PIM role schedule instances through Microsoft Graph and does not intentionally activate, assign, remove or change privileged roles.
Parameters
- CSV output path - Use a new absolute Windows CSV path, for example C:\\Temp\\entra-report.csv.
Output
Output: CSV with AssignmentState, AssignmentType, MemberType, principal/role identifiers and display metadata, directory/app scope, start/end timestamps and schedule-instance identifiers.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Exports Microsoft Entra PIM eligible and active directory-role schedule instances with principal, role, scope, assignment type and time-bound state in one CSV report.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7 with Microsoft.Graph.Authentication. Sign in with RoleEligibilitySchedule.Read.Directory and RoleAssignmentSchedule.Read.Directory, confirm your administrator role can read PIM data, choose a new CSV path and review the scope before running.
ValidationRecorded evidenceQA reviewed
Static QAPassed
PSScriptAnalyzerPassed
Runtime testedNot yet recorded
Last validatedNot yet recorded
Runtime and community evidence change only after an external tester result is reviewed and accepted for release evidence.
Tester: report a result →Was this useful?One click. No email.