PIM iteration 2-API's stoppen in oktober 2026: zo vind je wat ze nog aanroept

MicrosoftGraphActivityLogs
| where TimeGenerated > ago(30d)
| extend Path = tolower(replace_regex(tostring(parse_url(RequestUri).Path), @'/+', '/'))
| where Path startswith "/beta/privilegedaccess"
| summarize Requests = count(), LastSeen = max(TimeGenerated),
    Methods = make_set(RequestMethod), Paths = make_set(Path, 10),
    UserAgents = make_set(UserAgent, 5)
    by AppId, ServicePrincipalId, UserId
| sort by Requests desc

Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All"

$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$pattern = '^PrivilegedAccess\.(Read|ReadWrite)\.(AzureAD|AzureADGroup|AzureResources)$'
$roleNames = @{}
$graphSp.AppRoles | ForEach-Object { $roleNames[$_.Id] = $_.Value }

$appHits = Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All |
    Where-Object { $roleNames[$_.AppRoleId] -match $pattern } |
    Select-Object @{ n = 'Client'; e = { $_.PrincipalDisplayName } }, PrincipalId,
        @{ n = 'Type'; e = { 'Application' } }, @{ n = 'Permission'; e = { $roleNames[$_.AppRoleId] } }

$delegatedHits = Get-MgOauth2PermissionGrant -Filter "resourceId eq '$($graphSp.Id)'" -All |
    ForEach-Object {
        $grant = $_
        $grant.Scope -split ' ' | Where-Object { $_ -match $pattern } | ForEach-Object {
            [pscustomobject]@{
                Client      = (Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId).DisplayName
                PrincipalId = $grant.ClientId
                Type        = "Delegated ($($grant.ConsentType))"
                Permission  = $_
            }
        }
    } | Sort-Object PrincipalId, Type, Permission -Unique

@($appHits) + @($delegatedHits) | Sort-Object Client | Format-Table -AutoSize

Connect-MgGraph -Scopes "RoleAssignmentSchedule.ReadWrite.Directory"
$me = (Invoke-MgGraphRequest -Method GET -Uri '/v1.0/me?$select=id').id

$params = @{
    Action           = "selfActivate"
    PrincipalId      = $me
    RoleDefinitionId = "fe930be7-5e62-47db-91af-98c3a49a38b1"   # User Administrator
    DirectoryScopeId = "/"
    Justification    = "CHG0001234"
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime()
        Expiration    = @{ Type = "AfterDuration"; Duration = "PT2H" }
    }
}
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $params