Step-by-step deployment guide

The Microsoft Entra PIM Groups connector for Elimity Insights fetches Privileged Identity Management data for groups.

Microsoft Entra PIM Groups

The Microsoft Entra PIM Groups connector for Elimity Insights fetches Privileged Identity Management data for groups — which principals hold, or are eligible for, member/owner access to PIM-enabled groups — from Microsoft Entra ID. Follow the instructions below to set up the connector.

1. Which data is imported

The following entity types are imported:

• Principals — the users, groups, and service principals that hold or are eligible for group access

• Groups — the Entra groups that carry PIM assignments/eligibilities

• Group Assignment Schedule Instances — active PIM group assignments

• Group Eligibility Schedule Instances — eligible (not-yet-activated) PIM group assignments

Each PIM grant is modelled as its own entity (the schedule instance) sitting between a Principal and a Group. It carries the context a plain link can't hold — the access role (member or owner), how it was granted (direct or via a nested group), its start/end window, and whether it's active or merely eligible.

Attributes imported per entity type:

Principal — Type (User, Group, or Service Principal)

Group — Created, Description

Group Assignment Schedule Instance / Group Eligibility Schedule Instance (identical) — Principal name, Group, Access (member / owner), Type, Membership (Direct / nested group), Start time, End time, Status (Active / Expired)

2. Creating a dedicated app registration in Entra ID

As usual we recommend creating a dedicated account for this connector.

1. In Azure, open your tenant's app registrations by typing 'app registrations' in the global search bar and clicking the App registrations service.

2. Click New registration.

3. Choose a name for this registration (e.g. elimity-insights-pim-groups).

4. Leave the defaults for 'Supported account types' and 'Redirect URI' and click Register.

Note down both the client identifier and the tenant identifier.

3. Generating credentials for the new app registration

The connector authenticates as the app registration using a client secret. Click Certificates & secrets in the menu on the left and add a new client secret. Immediately note down the value (Entra shows it only once).

4. Granting read permissions to the Graph API

Click API permissions and add these Microsoft Graph → Application permissions, then grant admin consent:

• PrivilegedAssignmentSchedule.Read.AzureADGroup — read active PIM group assignments

• PrivilegedEligibilitySchedule.Read.AzureADGroup — read eligible PIM group assignments

• Directory.Read.All — enumerate all groups and resolve principal/group display names

5. Creating a source in Elimity Insights

1. Go to Sources → Add Source → search Custom → Set Up.

2. Click Set Up again and name the source (e.g. Microsoft Entra PIM Groups).

3. Select Upload export file, click Continue, and upload data-model-export.json.

4. Open the Config tab, click Edit, set Enable automatic imports via custom gateway to true, and fill in the Gateway URL: https://pim-entra-groups-gateway-1027270379075.europe-west1.run.app.

5. Click Add configuration value and add the three entries below.

6. Click Save and run. Monitor the Logs tab — this connector logs its progress as it probes each group (it reports counts and how many groups were skipped as not PIM-eligible); the Imports tab shows the per-run summary.

entra-pim-groups-datamodel.json

4KB

Open

Configuration option	Key (type exactly this)	Description
Tenant ID	Tenant ID	Tenant identifier from step 2.
Application ID	Application ID	Client identifier from step 2.
Application Secret	Application Secret	Client secret value from step 3.

---