Find-PimStrayTestObjects
Find objects left behind by test runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Finds groups and administrative units left behind by test runs (names starting with a test marker) in a tenant, and reports the directory roles they hold and who are their members and owners. Read-only: it changes nothing.
When to run it
After live test runs against a tenant, or on a schedule (-FailIfFound) as a sweep. It looks OUTSIDE PIM's own filters on purpose: test objects carry a marker prefix that PIM's filters never match, so drift checks cannot see them. Cleanup is a separate, deliberate act.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | A Microsoft Graph identity already connected in this PowerShell session (PIM's REST context: tenant, application + certificate, or interactive) with Group.Read.All, AdministrativeUnit.Read.All, RoleManagement.Read.Directory and GroupMember.Read.All -- or a Global Reader / Directory Readers user | the tenant | Lists marker-prefixed groups and administrative units, the directory role assignments, and the members and owners of each group. Read-only; with no tenant context the script scans nothing and says so. |
What it changes
Nothing - it only reads.
What it only reads
- groups whose display name starts with a marker (id, name, created date, role-assignable)
- administrative units whose display name starts with a marker
- directory role assignments (to report the directory role each found group holds)
- members and owners of each found group
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Marker | no | PIMCOREENGINE-, PIMTEST- | Object-name prefix(es) to look for. |
| -FailIfFound | no | false | Exit 3 when anything is found, so a scheduled run surfaces as a failure. Default: exit 0 (report only). |
Preview with -WhatIf
The script is read-only, so -WhatIf changes nothing about the run: it prints 'What if: this script is read-only ...' and then the same report.
Undo
Nothing to undo -- the script changes nothing.
Network
It connects to: login.microsoftonline.com (token), graph.microsoft.com
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager