Created by Claude - please verify

PIM for Groups - on-demand scan: two schedule queries per security group (the API needs a group id per call).

Required Microsoft Graph permissions

PrivilegedAssignmentSchedule.Read.AzureADGroup PrivilegedEligibilitySchedule.Read.AzureADGroup Group.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P2.

Endpoints: GET /v1.0/groups?$filter=securityEnabled eq true · GET /v1.0/identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=groupId eq '{id}' ($batch) · GET /v1.0/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances?$filter=groupId eq '{id}' ($batch)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

PIM for Groups - Standing & Eligible Access

PIM for Groups puts membership and ownership of a group behind just-in-time activation - often for groups that grant Azure, Intune or admin-portal access. Permanent active members of such groups defeat it. Role-assignable Groups shows current members; this report shows which memberships are standing, eligible or activated.

Press Run scan to query PIM for every security group.