Skip to content

Commit 7c964f5

Browse files
feat: Release PIMActivation v2.0.0 with Azure Resources and Parallel Processing Engine
- Add comprehensive Azure Resource PIM role support with cross-subscription enumeration - Implement high-performance parallel processing engine as default behavior - Add Select All button for bulk role selection in GUI - Split monolithic module into modular function files for maintainability - Add real-time progress tracking with emoji indicators and timing metrics - Implement thread-safe concurrent operations with configurable throttling - Enhance verbose output with detailed parallel processing feedback BREAKING CHANGE: Module structure reorganized into individual function files
1 parent 6dff14b commit 7c964f5

74 files changed

Lines changed: 8065 additions & 4629 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

CHANGELOG.md

Lines changed: 86 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,98 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
88
## [Unreleased]
99

1010
### Planned Features
11-
- **Azure Resource Roles**: Support for Azure subscription and resource-level PIM roles
1211
- **Profile Management**: Save and quickly activate frequently used role combinations and accounts
1312
- **Scheduling**: Plan role activations for future times
1413
- **Enhanced Reporting**: Built-in activation history and analytics
1514

1615
---
1716

17+
## [2.0.0] - 2025-12-29
18+
19+
### 🚀 Major New Features - Azure Resources Support
20+
- **Azure Resource Roles Support**: Complete integration with Azure Resource PIM for subscription, resource group, and individual resource role management
21+
- **Enhanced Role Display**: Azure roles display with `[Azure]` prefix and Entra portal-aligned resource/scope column mappings
22+
- **Cross-Subscription Support**: Automatic enumeration and role management across all accessible Azure subscriptions
23+
- **Intelligent Member Type Detection**: Advanced logic to distinguish between Direct and Inherited Azure role assignments based on scope hierarchy
24+
25+
### ⚡ Parallel Processing Engine
26+
- **Parallel Processing by Default**: High-performance concurrent execution for Azure, Entra, and Group policy operations
27+
- **Enhanced Verbose Output**: Real-time progress tracking with emoji indicators (✅, ❌) and timing metrics
28+
- **Intuitive Parameter Model**: Simple `DisableParallelProcessing` switch for users who prefer sequential processing
29+
- **Thread-Safe Operations**: ConcurrentBag and ConcurrentDictionary implementation for safe parallel result aggregation
30+
- **Smart Throttling**: Default ThrottleLimit of 10 concurrent operations with configurable limits up to 50
31+
32+
### 🏗️ Modular Architecture Enhancement
33+
- **Function File Separation**: Split monolithic module function files into individual function files for better maintainability and development workflow
34+
- **Organized Directory Structure**: Functions properly organized into Public, Private, UI, and RoleManagement folders
35+
- **Enhanced Module Loading**: Improved module initialization with proper function loading and dependency management
36+
- **Development Workflow**: Better code organization enabling easier collaborative development and testing
37+
- **Strengthened Folder Structure**: Added sub-folders for enhanced visability, maintainability and structure for the module
38+
39+
### ✅ Added
40+
- **Complete Azure Resource Integration**: New `Get-AzureResourceRoles` function providing comprehensive Azure role enumeration with deduplication
41+
- **Azure Module Management**: `Initialize-AzureResourceSupport` function for automatic Az.Accounts and Az.Resources module handling
42+
- **Advanced Scope Parsing**: Intelligent parsing of Azure ARM resource hierarchies (Tenant → Management Group → Subscription → Resource Group → Resource)
43+
- **PIM-Eligible Role Detection**: Support for both PIM-eligible and permanently active Azure Resource role assignments
44+
- **Enhanced UI Support**: Azure roles integrate seamlessly with existing role lists showing proper resource names and scope types
45+
- **Select All Button**: New UI button for quickly selecting all eligible roles for bulk activation
46+
- **Parallel Processing Support**: Concurrent execution for Azure subscriptions, Entra policies, and Group policies
47+
- **Real-Time Progress Tracking**: Enhanced verbose output with emoji indicators and performance timing metrics
48+
- **DisableParallelProcessing Parameter**: Optional switch to use sequential processing when needed
49+
50+
### ⚡ Enhanced Performance Features
51+
All v1.2.x performance optimizations maintained and extended to Azure resources:
52+
- **ArrayList Collections**: Optimal memory usage for large role sets across all role types
53+
- **Batch API Operations**: 85% reduction in API calls for role and policy retrieval
54+
- **Memoized Lookups**: Cached scope display name resolution to minimize repeated API calls
55+
- **Intelligent Deduplication**: Advanced role deduplication logic prevents duplicate Azure role entries
56+
- **Progressive Loading**: Granular progress tracking during Azure subscription enumeration
57+
- **Parallel Execution**: Concurrent operations across all role types and policy fetching for maximum performance
58+
59+
### 🔧 Enhanced Authentication
60+
- **Dual Context Management**: Simultaneous Microsoft Graph and Azure PowerShell authentication contexts
61+
- **Custom App Registration**: Preserved support for ClientId/TenantId parameters for custom app registrations
62+
- **Error Handling**: Comprehensive error handling for Azure authentication failures with informative user feedback
63+
- **Session State**: Proper cleanup and management of both Graph and Azure authentication sessions
64+
65+
### 🛠️ Technical Improvements
66+
- **Parallel Processing Architecture**: Concurrent execution engine built on PowerShell 7+ ForEach-Object -Parallel
67+
- **Modular File Structure**: Each function now in its own .ps1 file for better organization and maintainability
68+
- **Enhanced Error Handling**: Comprehensive error handling across all operations with informative user feedback
69+
- **Memory Optimization**: Efficient resource usage and proper cleanup across all operations
70+
71+
### 📋 Technical Requirements
72+
- **PowerShell 7.0+**: Maintained existing PowerShell Core requirement for parallel processing capabilities
73+
- **Az.Accounts 5.1.0+**: Auto-installed when Azure resources functionality is requested
74+
- **Az.Resources 6.0.0+**: Auto-installed for PIM role eligibility schedule access
75+
- **Microsoft Graph Modules**: Existing Graph PowerShell module requirements preserved
76+
77+
### 🏗️ Architecture Improvements
78+
- **Modular Design**: Azure functionality cleanly integrated without impacting existing Entra ID and Group role processing
79+
- **Function Separation**: Complete restructuring into individual function files for enhanced maintainability
80+
- **Backward Compatibility**: All existing parameters and functionality preserved - purely additive changes
81+
- **Resource Type Abstraction**: Unified role object model supports Entra, Group, and Azure resource roles seamlessly
82+
- **Scope Hierarchy**: Advanced scope parsing supports complex Azure resource hierarchies and inheritance patterns
83+
- **Performance Optimization**: Parallel processing architecture provides dramatic speed improvements
84+
85+
### 💡 User Experience Enhancements
86+
- **Default Fast Performance**: Users get optimal performance out-of-the-box without configuration
87+
- **Flexible Control**: Users can disable parallel processing if needed for troubleshooting or compatibility
88+
- **Informative Messages**: Enhanced verbose output explains why sequential processing is used when parallel is disabled
89+
90+
### 📚 Documentation
91+
- **Comprehensive Examples**: Updated documentation with Azure resource role activation scenarios and parallel processing
92+
- **Best Practices**: Guidance for managing roles across multiple Azure subscriptions and optimizing performance
93+
- **Troubleshooting**: Common Azure authentication, permission issues, and parallel processing scenarios addressed
94+
- **Performance Best Practices**: Guidance on when to use parallel vs sequential processing
95+
- **Updated Parameter Documentation**: All functions now document DisableParallelProcessing and updated ThrottleLimit defaults
96+
97+
### 🚨 Breaking Changes
98+
- **New Parameter**: Added `DisableParallelProcessing` switch (parallel processing enabled by default)
99+
- **Module Structure**: Functions moved to individual files (no impact on public API)
100+
101+
---
102+
18103
## [1.2.6] - 2025-11-27
19104

20105
### Added

PIMActivation.psd1

Lines changed: 54 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,90 +1,112 @@
11
@{
22
# Script module or binary module file associated with this manifest.
3-
RootModule = 'PIMActivation.psm1'
3+
RootModule = 'PIMActivation.psm1'
44

55
# Version number of this module.
6-
ModuleVersion = '1.2.6'
6+
ModuleVersion = '2.0.0'
77

88
# Supported PSEditions - Requires PowerShell Core (7+)
99
CompatiblePSEditions = @('Core')
1010

1111
# ID used to uniquely identify this module
12-
GUID = 'a3f4b8e2-9c7d-4e5f-b6a9-8d7c6b5a4f3e'
12+
GUID = 'a3f4b8e2-9c7d-4e5f-b6a9-8d7c6b5a4f3e'
1313

1414
# Author of this module
15-
Author = 'Sebastian Flæng Markdanner'
15+
Author = 'Sebastian Flæng Markdanner'
1616

1717
# Company or vendor of this module
18-
CompanyName = 'Cloudy With a Change Of Security'
18+
CompanyName = 'Cloudy With a Change Of Security'
1919

2020
# Copyright statement for this module
21-
Copyright = '(c) 2025 Sebastian Flæng Markdanner. All rights reserved.'
21+
Copyright = '(c) 2025 Sebastian Flæng Markdanner. All rights reserved.'
2222

2323
# Description of the functionality provided by this module
24-
Description = 'PowerShell module for managing Microsoft Entra ID Privileged Identity Management (PIM) role activations through a modern GUI interface. Supports authentication context, bulk operations, and policy compliance. Developed with AI assistance. Requires PowerShell 7+.'
24+
Description = 'PowerShell module for managing Microsoft Entra ID Privileged Identity Management (PIM) role activations through a modern GUI interface. Supports Entra ID roles, PIM-enabled groups, and Azure Resource roles. Features authentication context, bulk operations, and policy compliance. Developed with AI assistance. Requires PowerShell 7+.'
2525

2626
# Minimum version of the PowerShell engine required by this module
27-
PowerShellVersion = '7.0'
27+
PowerShellVersion = '7.0'
2828

2929
# Script to run after the module is imported
30-
ScriptsToProcess = @()
30+
ScriptsToProcess = @()
3131

3232
# Required modules - conditionally enforced based on availability
3333
# Auto-installation logic in PSM1 handles missing modules
34-
RequiredModules = @()
34+
RequiredModules = @()
3535

3636
# Functions to export from this module
37-
FunctionsToExport = @(
37+
FunctionsToExport = @(
3838
'Start-PIMActivation'
3939
)
4040

4141
# Cmdlets to export from this module
42-
CmdletsToExport = @()
42+
CmdletsToExport = @()
4343

4444
# Variables to export from this module
45-
VariablesToExport = @()
45+
VariablesToExport = @()
4646

4747
# Aliases to export from this module
48-
AliasesToExport = @()
48+
AliasesToExport = @()
4949

5050
# Private data to pass to the module specified in RootModule/ModuleToProcess
51-
PrivateData = @{
51+
PrivateData = @{
5252
PSData = @{
5353
# Tags applied to this module for online gallery discoverability
54-
Tags = @('PIM', 'PrivilegedIdentityManagement', 'EntraID', 'AzureAD', 'Identity', 'Governance', 'RBAC', 'GUI', 'Authentication', 'ConditionalAccess', 'Security', 'Microsoft', 'Graph')
54+
Tags = @('PIM', 'PrivilegedIdentityManagement', 'EntraID', 'AzureAD', 'Azure', 'AzureResources', 'Identity', 'Governance', 'RBAC', 'GUI', 'Authentication', 'ConditionalAccess', 'Security', 'Microsoft', 'Graph')
5555

5656
# A URL to the license for this module.
57-
LicenseUri = 'https://github.com/Noble-Effeciency13/PIMActivation/blob/main/LICENSE'
57+
LicenseUri = 'https://github.com/Noble-Effeciency13/PIMActivation/blob/main/LICENSE'
5858

5959
# A URL to the main website for this project.
60-
ProjectUri = 'https://github.com/Noble-Effeciency13/PIMActivation'
60+
ProjectUri = 'https://github.com/Noble-Effeciency13/PIMActivation'
6161

6262
# A URL to an icon representing this module.
63-
IconUri = 'https://raw.githubusercontent.com/Noble-Effeciency13/PIMActivation/main/Resources/icon.png'
63+
IconUri = 'https://raw.githubusercontent.com/Noble-Effeciency13/PIMActivation/main/Resources/icon.png'
6464

6565
# ReleaseNotes
66-
ReleaseNotes = @'
67-
## PIMActivation v1.2.6
66+
ReleaseNotes = @'
67+
## PIMActivation v2.0.0 - Azure Resources & Parallel Processing Engine
68+
69+
### 🚀 Major New Features
70+
- **Azure Resource Roles Support**: Full integration with Azure Resource PIM for subscription, resource group, and individual resource role management
71+
- **Parallel Processing Engine**: High-performance concurrent execution for all operations with real-time progress tracking
72+
- **Enhanced Role Display**: Azure roles display with [Azure] prefix and portal-aligned resource/scope columns
73+
- **Cross-Subscription Support**: Automatic enumeration and management across all accessible Azure subscriptions
74+
- **Modular Architecture**: Split functions into individual files for better maintainability
75+
76+
### ⚡ Performance Features
77+
- **Parallel Processing by Default**: Concurrent execution for Azure, Entra, and Group operations
78+
- **Real-Time Progress Tracking**: Enhanced verbose output with emoji indicators (🚀, ✅, ❌) and timing metrics
79+
- **Smart Throttling**: Default ThrottleLimit of 10 concurrent operations, configurable up to 50
80+
- **Thread-Safe Operations**: ConcurrentBag and ConcurrentDictionary for safe parallel result aggregation
6881
6982
### ✅ Added
70-
- Support for custom app registration for Microsoft Graph delegated auth. New parameters `ClientId` and `TenantId` are available on `Start-PIMActivation` and `Connect-PIMServices`. When both are provided, the module authenticates using the specified app registration; otherwise, it falls back to the default interactive flow.
83+
- Complete Azure Resource role activation and deactivation support
84+
- Select All button for bulk role selection in GUI
85+
- `Get-AzureResourceRoles` function with parallel subscription processing
86+
- `Initialize-AzureResourceSupport` for Azure module management
87+
- `DisableParallelProcessing` parameter for sequential processing when needed
88+
- Enhanced scope parsing for Azure ARM resource hierarchies
89+
- Support for both PIM-eligible and active Azure Resource role assignments
7190
72-
### 🔧 Fixes
73-
- Resolved Microsoft Graph query limitations when collecting role policies for large sets (e.g., >20 eligible roles of the same type). Implemented chunked batching and a REST-based path with pagination so policies are fetched reliably at scale.
74-
- Added robust fallback to per-item fetching when the service rejects complex filters or returns zero results.
75-
- Corrected control flow and ensured `-ErrorAction Stop` on policy assignment calls so fallbacks always trigger when needed.
76-
- Addressed a transient InvalidResource/InvalidFilter regression introduced during the fix and removed it.
91+
### 🔧 Enhanced Performance
92+
- All v1.2.x optimizations preserved and extended:
93+
- ArrayList-based collections for optimal memory usage
94+
- Batch API operations reducing Graph calls by 85%
95+
- Memoized scope display name lookups
96+
- Intelligent role deduplication and caching
97+
- NEW: Parallel processing across all role types and policy operations
7798
78-
### ⚡ Improvements
79-
- Performance: Replaced array concatenations with `ArrayList`/`AddRange` in hot paths (role collection and batch aggregations).
80-
- Stability: Flattened `ArrayList` before mapping policies; treat `InvalidResource` like `InvalidFilter` for resilient behavior.
81-
- Caching: Memoized scope and AU display name lookups in `Get-ScopeDisplayName` to reduce repeated Graph calls.
99+
### 📋 Requirements
100+
- PowerShell 7.0+ (required for parallel processing engine)
101+
- Az.Accounts 5.1.0+ and Az.Resources 6.0.0+ (auto-installed for Azure resources)
102+
- Microsoft Graph PowerShell modules (existing requirements preserved)
82103
83104
### 📚 More
84105
- Changelog: https://github.com/Noble-Effeciency13/PIMActivation/blob/main/CHANGELOG.md
106+
- Blog Post: https://www.chanceofsecurity.com/post/microsoft-entra-pim-bulk-role-activation-tool
85107
- Releases: https://github.com/Noble-Effeciency13/PIMActivation/releases
86108
87-
PowerShell module for Microsoft Entra ID PIM role activations with a modern GUI. Requires PowerShell 7+.
109+
PowerShell module for comprehensive PIM role management across Entra ID, Groups, and Azure Resources with parallel processing engine and modern GUI.
88110
'@
89111
# Flag to indicate whether the module requires explicit user acceptance
90112
RequireLicenseAcceptance = $false

0 commit comments

Comments
 (0)