Created by Claude - please verify

PIM activations - self-activation requests of the last 30 days grouped by person and role. Times in UTC.

Required Microsoft Graph permissions

RoleManagement.Read.Directory User.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P2.

Endpoints: GET /v1.0/roleManagement/directory/roleAssignmentScheduleRequests?$filter=action eq 'selfActivate' · GET /v1.0/roleManagement/directory/roleDefinitions

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

PIM Activation Patterns (30 days)

Who activates which role, how often, when and why. A role activated almost every day is standing access in disguise - make it permanent with a narrower role, or question the need. Tier-0 roles activated at night or at weekends deserve a look, and one-word justifications defeat the purpose of asking.