Azure PIM elevation from your terminal — no portal required.
Works in PowerShell, GitHub Copilot CLI, and VS Code Copilot Chat.
Switching to the Azure Portal just to activate a PIM role breaks your flow. PimElevation brings privileged role management directly into the tools you already live in:
- 🖥️ Any PowerShell terminal — one command, done
- 🤖 GitHub Copilot CLI — just say "PIM elevate"
- 💬 VS Code Copilot Chat — ask naturally, get elevated
No portal tabs. No clicking through menus. No context switching.
git clone <this-repo> D:\Git\pim-elevation
cd D:\Git\pim-elevation
.\Install-PimElevation.ps1That's it. The installer sets up everything — the PowerShell module, a PATH-accessible script, and the Copilot skill.
Use
-SkipModule,-SkipScript, or-SkipSkillto install selectively. Use-Forceto overwrite.
📦 What gets installed
| Component | Destination | Purpose |
|---|---|---|
| PowerShell module | ~\Documents\PowerShell\Modules\PimElevation\ |
Auto-loads Invoke-PimElevation in any pwsh session |
| Wrapper script | ~\Scripts\Invoke-PimElevation.ps1 |
Runs from PATH; used by Copilot agents |
| Copilot skill | ~\.copilot\skills\pim-elevate\SKILL.md |
Discoverable by GitHub Copilot CLI + VS Code |
🔧 Manual installation
# Module
$modPath = Join-Path ([Environment]::GetFolderPath('MyDocuments')) "PowerShell\Modules\PimElevation"
New-Item -ItemType Directory -Path $modPath -Force
Copy-Item module\PimElevation\* $modPath
# Script
Copy-Item scripts\Invoke-PimElevation.ps1 "$env:USERPROFILE\Scripts\"
# Copilot skill
$skillPath = "$env:USERPROFILE\.copilot\skills\pim-elevate"
New-Item -ItemType Directory -Path $skillPath -Force
Copy-Item skill\pim-elevate\SKILL.md $skillPathInvoke-PimElevation # Elevate Owner, default sub
Invoke-PimElevation -Action Status # What's active?
Invoke-PimElevation -Action ListEligible # What can I activate?
Invoke-PimElevation -Role Contributor -Duration PT4H # Specific role & duration
Invoke-PimElevation -Subscription "MCAPS" # Target by name fragmentJust talk to it:
"PIM elevate" "Am I elevated?" "What PIM roles can I activate?" "Elevate as Contributor for 4 hours"
| Parameter | Default | Values |
|---|---|---|
-Action |
Elevate |
Elevate · Status · ListEligible |
-Subscription |
Current az default |
GUID, name fragment, or omit |
-Role |
Owner |
Any eligible role name |
-Duration |
PT8H |
PT1H · PT2H · PT4H · PT8H |
-Justification |
"PIM activation" |
Free text |
| Status | Meaning |
|---|---|
✅ Provisioned |
Role is active |
✅ AlreadyActive |
Already elevated (idempotent) |
🔄 Accepted |
Propagating — active within seconds |
⏳ PendingApproval |
Requires admin approval |
❌ NoEligibleRoles |
No PIM assignments on this subscription |
RoleNotEligible |
Role not in your eligible list (alternatives shown) |
Set your fallback subscription in PimElevation.psm1:
$script:DefaultSubscriptionId = "a90072fb-63bb-4099-bf52-e3b41616cec4"Resolution order: explicit -Subscription param → az account show default → configured fallback.
Invoke-Pester .\tests\PimElevation.Tests.ps1Tests validate REST API structure — URL paths, query parameters, request bodies, and response parsing — so you'll catch breaking changes if Azure updates their PIM API surface.
See docs/architecture.md for project structure, component flow, and API details.
- PowerShell 7+ (
pwsh) - Azure CLI (
az) — authenticated viaaz login - PIM-eligible role assignment on the target subscription
- Interactive user login (not a service principal)
| Problem | Fix |
|---|---|
| "Failed to get ARM access token" | Run az login |
| "PIM elevation requires interactive user login" | Use az login interactively (not service principal) |
| "No eligible PIM role assignments found" | Check Azure Portal → PIM → My roles |
| Module not found | Get-Module -ListAvailable PimElevation — if empty, re-run installer |
| Script not in PATH | Add $env:USERPROFILE\Scripts to your PATH |