Azure CLI app registration should have delegated API permissions for PIM manipulation

[TeamDman]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

az rest

Would be neat if there was official Azure CLI support for both AzureRM and Entra PIM list/create/show/activate/deactivate/config flows

az pim (not yet a thing)
az ad pim (not yet a thing)

Resource Provider

N/A

Description of Feature or Work Requested

As a user of the Azure platform, I value having the az cli for testing documented REST APIs without having to create a custom app registration.

The Azure CLI should be able to make requests to https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests/

Currently, the following error is produced instead of a successful result:

Forbidden({"error":{"code":"UnknownError","message":"{"errorCode":"PermissionScopeNotGranted","message":"Authorization failed due to missing permission scope RoleAssignmentSchedule.ReadWrite.Directory,RoleManagement.ReadWrite.Directory,RoleAssignmentSchedule.Remove.Directory.","instanceAnnotations":[]}","innerError":{"date":"2026-06-29T13:05:49","request-id":"081da91f-e0d0-47c0-923d-f64a52b0aa04","client-request-id":"081da91f-e0d0-47c0-923d-f64a52b0aa04"}}})

This is due to missing delegated permissions on the app registration for the Azure CLI which is controlled by Microsoft.

Requests do succeed from the graph explorer, but not from the az cli.

Attempting to acquire an access token to perform the rest requests manually produces errors:

❯ az account get-access-token --resource-type ms-graph --scope "PrivilegedAccess.ReadWrite.AzureAD"
V2Error: invalid_request AADSTS65002: Consent between first party application '04b07795-8ddb-461a-bbee-02f9e1bf7b46' and first party resource '00000003-0000-0000-c000-000000000000' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID: 39a1e2e0-cfd3-4b2a-b6dd-a7e86e436900 Correlation ID: bc856bda-f07f-4566-a322-e0605d3fd50f Timestamp: 2026-07-23 17:50:35Z. Status: Response_Status.Status_IncorrectConfiguration, Error code: 3399614466, Tag: 557973643
Run the command below to authenticate interactively; additional arguments may be added as needed:
az logout
az login --tenant "redacted" --scope "PrivilegedAccess.ReadWrite.AzureAD"

Logging in with the recommended --scope "PrivilegedAccess.ReadWrite.AzureAD" produces the same result.

---

The Azure portal used to use this URL when activating Entra PIM roles through click-ops:
The Azure CLI has never been able to use az rest against this url:

https://api.azrbac.mspim.azure.com/api/v2/privilegedAccess/aadroles/roleAssignments

The Azure CLI used to be able to use az rest against this url:

https://graph.microsoft.com/beta/privilegedAccess/aadroles/roleAssignments

The Azure portal now uses this URL when activating roles through click-ops:
The Azure CLI is unable to use az rest against this url:

https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests

See:

#28854

---

I was able to set up a new app registration to smoke test the PIM actions that the Azure CLI change broke

data "azuread_application_published_app_ids" "well_known" {}

data "azuread_service_principal" "msgraph" {
  # https://github.com/hashicorp/go-azure-sdk/blob/1e4e35bbf6ca98098281b4c963de73f4b40cb8f0/sdk/environments/application_ids.go#L112C3-L112C17
  client_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
}


resource "azuread_application_api_access" "msgraph" {
  application_id = azuread_application_registration.main.id
  api_client_id  = data.azuread_service_principal.msgraph.client_id

  role_ids = [
  ]

  scope_ids = [
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.ReadBasic.All"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["PrivilegedEligibilitySchedule.Read.AzureADGroup"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["PrivilegedAccess.Read.AzureADGroup"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["PrivilegedAccess.Read.AzureAD"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["PrivilegedAccess.ReadWrite.AzureAD"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["PrivilegedAccess.ReadWrite.AzureADGroup"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["RoleAssignmentSchedule.ReadWrite.Directory"],
    data.azuread_service_principal.msgraph.oauth2_permission_scope_ids["RoleManagement.ReadWrite.Directory"],
  ]
}

resource "azuread_application_fallback_public_client" "main" {
  application_id = azuread_application_registration.main.id
  enabled = true
}

resource "azuread_application_redirect_uris" "main" {
  application_id = azuread_application_registration.main.id
  type = "PublicClient"
  redirect_uris = [
    "http://localhost",
    "https://localhost",
  ]
}

https://github.com/AAFC-Cloud/Cloud-Terrastodon/blob/d2fb0e929bf3be6f071ce8a045f93207219377a1/crates/credentials/src/pim_graph_access_token.rs#L114

This was successful in enabling programmatic activation of existing PIM eligible role assignments, however, it is not a nice solution when it requires configuring the app registration in every tenant that tooling will be used in when instead this is a gap that should be filled by the Azure CLI’s app registration.
I believe that the permissions in the above registration are excessive but I did not try reducing them to see what the minimum was.

My understanding is that by introducing new Delegated permission grants to the app registration for the Azure CLI, there is low risk:
User (unprivileged) -> Azure CLI app registration public client credential flow -> Azure PIM API -> failure, user does not have the required permission to delegate to the Azure CLI
User (privileged) -> Azure CLI app registration public client credential flow -> Azure PIM API -> success, user has the required permission to delegate to the Azure CLI

---

See also:
#28854
#28628
#30149
hashicorp/terraform-provider-azuread#1386
hashicorp/terraform-provider-azuread#1069

Minimum API Version Required

N/A

Swagger PR link / SDK link

N/A

Request Example

az rest --method POST --url https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests/ --body '@body.json'

where body.json is

{
    "action": "selfActivate",
    "principalId": "2a66ec41-3646-4e92-8935-dadf5999b650",
    "roleDefinitionId": "fdd7a751-b60b-444a-984c-02652fe8fa1c",
    "directoryScopeId": "/",
    "justification": "testing",
    "scheduleInfo": {
        "startDateTime": "2026-06-12T16:00:00.000Z",
        "expiration": {
            "type": "AfterDuration",
            "duration": "PT1H"
        }
    },
    "ticketInfo": {
        "ticketNumber": "CONTOSO:Normal-67890",
        "ticketSystem": "MS Project"
    }
}

Target Date

2026-09-01

PM Contact

@walkenygomez

Engineer Contact

@maybelingnavarrete

Additional context

This feature request is in response to direction from Microsoft in TrackingID#2605050040006158 started on 2026-05-05

It is Microsoft's position that the ability to activate Entra PIM roles which was previously working with the az rest command is undocumented and therefore unsupported and that the new-feature flow should be followed for restoring/introducing functionality rather than treating it as a bug.

My understanding is that this also impacts the Terraform providers which rely upon the Azure CLI credential.

[yonzhan]

Thank you for opening this issue, we will look into it.

[TeamDman]

Some additional links that may be useful

Create roleAssignmentScheduleRequests - Microsoft Graph v1.0 | Microsoft Learn

unifiedRoleAssignmentScheduleRequest resource type - Microsoft Graph beta | Microsoft Learn

List governanceRoleSettings (deprecated) - Microsoft Graph beta | Microsoft Learn

List roleAssignmentScheduleRequests - Microsoft Graph v1.0 | Microsoft Learn

Manage Microsoft Entra role assignments using the PIM APIs - Microsoft Graph v1.0 | Microsoft Learn

Eligible Child Resources - Get - REST API (Azure Authorization) | Microsoft Learn

Naming rules and restrictions for Azure resources - Azure Resource Manager | Microsoft Learn

Microsoft Entra built-in roles - Microsoft Entra ID | Microsoft Learn

Microsoft identity platform and OAuth 2.0 authorization code flow - Microsoft identity platform | Microsoft Learn