PIM Manager MCP tools

Access requests (RFA): account windows and ad-hoc group memberships -- state, who, how long, who decided.

Role: Admin

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Access review campaigns: what is open, for whom, and how far along. (Same answer as /api/access-review-campaigns for your role.)

Role: Reader · Runs: GET /api/access-review-campaigns

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Access reviews: definitions, instances, decisions and counts. (Same answer as /api/access-reviews for your role.)

Role: Reader · Runs: GET /api/access-reviews

Inputs: query (object) - more query parameters, as the page sends them (name -> value); pimManagedOnly (boolean) - only reviews of PIM-managed groups

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Active and eligible PIM assignments right now (Entra roles, PIM for Groups, Azure roles), paged and filterable as on the Active assignments page. (Same answer as /api/active-assignments for your role.)

Role: Admin · Runs: GET /api/active-assignments

Inputs: pageSize (integer); page (integer); q (string) - text filter; query (object) - more query parameters, as the page sends them (name -> value); type (string) - e.g. pim-for-groups, entra-roles, azure-roles

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The approvals queue: changes waiting for a second person, who asked, what, since when. (Same answer as /api/approvals for your role.)

Role: Reader · Runs: GET /api/approvals

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Search the audit trail (last month): who did what, when, with what result.

Role: Admin

Inputs: contains (string); top (integer)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Assignments that run out soon and what auto-extend will do with each. (Same answer as /api/autoextend/upcoming for your role.)

Role: Reader · Runs: GET /api/autoextend/upcoming

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Commit history: the saved commits (who, when, approved by, how many rows), as on the Commit history page for your role. (Same answer as /api/commit-history for your role.)

Role: Admin · Runs: GET /api/commit-history

Inputs: query (object) - more query parameters, as the page sends them (name -> value); days (integer) - how many days back (default 90)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

ONE saved commit: its rows (before and after) and what an undo would do, as on the Commit history page for your role. (Same answer as /api/commit-history/<commitId> for your role.)

Role: Admin · Runs: GET /api/commit-history/{p1}

Inputs: commitId (string, required) - the commit id (commit_history lists them); query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

What happened to a commit, by the commit id commit_staged returned: done (with its answer -- saved or refused, and why), running, saved (found in the change journal), or unknown (no record -- it did not land). Never a guess.

Role: Reader

Inputs: commitId (string, required) - the commitId from commit_staged (8-64 letters, digits, - or _)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Conformance of ONE template: each entry's status in this environment, its rollout ring, and the counts. (Same answer as /api/conformance for your role.)

Role: Reader · Runs: GET /api/conformance

Inputs: query (object) - more query parameters, as the page sends them (name -> value); template (string, required) - the template id (conformance_templates lists them)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The conformance exemptions recorded for this environment: what is exempt, why, who approved it, until when, and its state. (Same answer as /api/conformance/exemptions for your role.)

Role: Reader · Runs: GET /api/conformance/exemptions

Inputs: query (object) - more query parameters, as the page sends them (name -> value); template (string) - only this template (optional)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Fleet conformance: environments x templates, how far behind each is. (Same answer as /api/conformance/fleet for your role.)

Role: Reader · Runs: GET /api/conformance/fleet

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The rollout plan of ONE template by ring: which environments each ring reaches and where each stands. (Same answer as /api/conformance/ring-plan for your role.)

Role: Reader · Runs: GET /api/conformance/ring-plan

Inputs: query (object) - more query parameters, as the page sends them (name -> value); template (string, required) - the template id

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Template rollout: the configuration templates, their version, whether each is approved, and how far this environment is behind. (Same answer as /api/conformance/templates for your role.)

Role: Reader · Runs: GET /api/conformance/templates

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Coverage: privileged access in the tenant that PIM does not manage yet (the last coverage report). (Same answer as /api/coverage for your role.)

Role: Reader · Runs: GET /api/coverage

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Drift: where the tenant differs from the configuration (the last drift snapshot), as on the Drift page. (Same answer as /api/drift for your role.)

Role: Reader · Runs: GET /api/drift

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The environment report: identities, permissions, hosting and settings of this install, as the page builds it. (Same answer as /api/environment-report for your role.)

Role: Admin · Runs: GET /api/environment-report

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Guards: the protections in place (what they hold, who set them, until when). (Same answer as /api/guards for your role.)

Role: Reader · Runs: GET /api/guards

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The run history of ONE engine job (status, start, duration, detail). (Same answer as /api/jobs/history for your role.)

Role: Reader · Runs: GET /api/jobs/history

Inputs: name (string, required) - the job name (jobs_status lists them); query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The log of ONE job run, by its run id (from job_history). (Same answer as /api/jobs/log for your role.)

Role: Reader · Runs: GET /api/jobs/log

Inputs: runId (string, required); query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Every engine job: enabled, cadence, last run (status, when, detail) and next run.

Role: Reader

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Rows of one configuration entity (e.g. Account-Definitions-Admins, PIM-Assignments-Admins, PIM-Definitions-Roles), optionally only those containing a text. Scoped to what you may see.

Role: Reader

Inputs: entity (string, required); contains (string); top (integer) - at most this many rows (default 50, max 500)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Owner reviews: the people a department owner is asked to keep, extend or remove. (Same answer as /api/owner/people for your role.)

Role: Reader · Runs: GET /api/owner/people

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Everything staged and waiting to be committed (per entity: add / modify / remove, the row key, who staged it, when).

Role: Reader

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The validation report (Check for problems): errors and warnings in the configuration, with the entity, row and a fix hint.

Role: Reader

Inputs: top (integer); severity (string)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Compare two roles: who reaches each, who reaches both (Role lookup > compare). (Same answer as /api/role-lookup/compare for your role.)

Role: Reader · Runs: GET /api/role-lookup/compare

Inputs: roleA (string, required); roleB (string, required); query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Reverse role lookup: everything that grants ONE role (definitions, groups, nesting). (Same answer as /api/role-lookup/reverse for your role.)

Role: Reader · Runs: GET /api/role-lookup/reverse

Inputs: kind (string); role (string, required); query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

The permissions ONE directory role grants, grouped (Role lookup > permissions). (Same answer as /api/role-permissions for your role.)

Role: Reader · Runs: GET /api/role-permissions

Inputs: query (object) - more query parameters, as the page sends them (name -> value); role (string, required) - the directory role name

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Which directory roles grant ONE action, the narrowest role first (Role lookup > find roles by action). (Same answer as /api/role-permissions/by-action for your role.)

Role: Reader · Runs: GET /api/role-permissions/by-action

Inputs: query (object) - more query parameters, as the page sends them (name -> value); action (string, required) - e.g. microsoft.directory/users/basic/update

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Search the Manager (admins, groups, roles, definitions) the way the page's search box does. (Same answer as /api/search for your role.)

Role: Reader · Runs: GET /api/search

Inputs: query (object) - more query parameters, as the page sends them (name -> value); q (string, required) - what to find

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Tier impact (Pro): for each role tier (0, 1 or 2), what its roles reach and who holds them. (Same answer as /api/tier-impact for your role.)

Role: Reader · Runs: GET /api/tier-impact

Inputs: tier (string) - 0, 1 or 2; query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Privileged accounts found in the tenant that PIM does not manage, with what they hold. (Same answer as /api/unmanaged-admins for your role.)

Role: Admin · Runs: GET /api/unmanaged-admins

Inputs: query (object) - more query parameters, as the page sends them (name -> value)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

What a person (admin account UPN or name) can reach: every role, group and resource, directly and through nesting.

Role: Reader

Inputs: person (string, required) - admin account UPN or user name

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Who can activate a role or reach a target (Entra role, AU-scoped role, Azure resource role).

Role: Reader

Inputs: kind (string); role (string, required) - role name or node id

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Your identity and PIM Manager role, and this environment's version.

Role: Reader

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Approve or deny ONE waiting access request, as a department Owner or Admin on the Access requests page (never your own request). (Same checks as POST /api/rfa/decide.)

Role: Reader · Runs: POST /api/rfa/decide

Inputs: note (string); id (string, required) - the request id (access_requests lists them); decision (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

END one approved or active access request now, as a department Owner or Admin on the Access requests page. (Same checks as POST /api/rfa/end.)

Role: Reader · Runs: POST /api/rfa/end

Inputs: id (string, required) - the request id

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Decide ONE person in an access-review campaign (keep / remove, optionally naming the access), as the campaign page does. (Same checks as POST /api/access-review-campaigns/decide.)

Role: Admin · Runs: POST /api/access-review-campaigns/decide

Inputs: user (string, required); access (array) - the access to remove (optional); id (string, required) - the campaign id; decision (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Record ONE access-review decision (Approve / Deny with a justification), as on the Access reviews page. (Same checks as POST /api/access-reviews/decision.)

Role: Admin · Runs: POST /api/access-reviews/decision

Inputs: decisionId (string, required); definitionId (string, required); instanceId (string, required); justification (string, required); outcome (string, required) - the outcome the Access reviews page sends (e.g. Approve or Deny)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Approve or reject ONE waiting approval (the second-person check of the Approvals page: never your own request). (Same checks as POST /api/approvals/decide.)

Role: Admin · Runs: POST /api/approvals/decide

Inputs: note (string); id (string, required) - the approval id (approvals lists them); decision (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Decide ONE upcoming auto-extension (extend or let it end), with a reason. (Same checks as POST /api/autoextend/decide.)

Role: Admin · Runs: POST /api/autoextend/decide

Inputs: reason (string); key (string, required) - the key from autoextend_upcoming; decision (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

COMMIT the changes YOU staged on one entity, through exactly the same commit as the Manager's Review & commit: validation, the second-approver rule, the approval for the two most privileged tiers, the offboarding hold and concurrency checks all apply, and a refusal says why. The engine then applies the committed rows; follow it with the commit id in the Manager's commit watcher.

Role: Admin

Inputs: entity (string, required); ticket (string); justification (string) - why -- recorded with the commit

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

WITHDRAW changes YOU staged on one entity (one row by its key, or all of yours on that entity). Nothing stored changes -- only your pending change goes. A reason is required and recorded. Another administrator's staged change is never touched here.

Role: Admin

Inputs: entity (string, required) - e.g. PIM-Assignments-Admins; reason (string, required) - why -- recorded with the discard; key (string) - the row key (as pending_changes lists it); omit = every change of yours on this entity

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Cancel ONE running engine job. (Same checks as POST /api/jobs/cancel.)

Role: SuperAdmin · Runs: POST /api/jobs/cancel

Inputs: name (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Run ONE engine job now (as the Jobs page's Run now). (Same checks as POST /api/jobs/run.)

Role: Admin · Runs: POST /api/jobs/run

Inputs: name (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

Start ONE scheduled job at once (the Schedule page's Run now). (Same checks as POST /api/job-schedule/run-now.)

Role: SuperAdmin · Runs: POST /api/job-schedule/run-now

Inputs: name (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

As a department owner (or Admin): extend ONE person's access to a new date, with a reason. (Same checks as POST /api/owner/extend.)

Role: Reader · Runs: POST /api/owner/extend

Inputs: newDate (string, required) - yyyy-MM-dd; reason (string, required); userName (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

As a department owner: KEEP one person (the owner review answer), with a reason. (Same checks as POST /api/owner/keep.)

Role: Reader · Runs: POST /api/owner/keep

Inputs: reason (string, required); userName (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

As a department owner: answer REMOVE for one person -- it raises the offboarding request through the page's own approval, never a direct delete. (Same checks as POST /api/owner/remove.)

Role: Reader · Runs: POST /api/owner/remove

Inputs: reason (string, required); userName (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)

STAGE one change to a configuration entity (add a row, modify fields of a row, or remove a row). It is NOT applied: it waits under Pending changes, locked to you, until it is committed in the PIM Manager (Review & commit), with every check the Manager runs.

Role: Admin

Inputs: entity (string, required) - e.g. PIM-Assignments-Admins; row (object, required) - add: the whole row. modify: the key fields + the fields to change. remove: the key fields.; op (string, required)

Answer: JSON text: the same answer the PIM Manager page gets for this action (an error says why)