List Expiring Role Assignments

List Azure AD role assignments expiring within a given number of days

Description

Lists active and PIM-eligible Azure AD role assignments that expire within a specified number of days. The output includes role name, principal, and expiration date.

Location

Organization → Security → List Expiring Role Assignments

Full Runbook name

rjgit-org_security_list-expiring-role-assignments

Details

Property	Value
Version	1.0.1
Required modules	RealmJoin.RunbookHelper (>= 0.8.9)
Schedulable	no

Permissions

Application permissions

• Type: Microsoft Graph

  • RoleManagement.Read.All

    • Reads role assignment schedules, eligibility schedules and role definitions
  • User.Read.All

    • Resolves each assignment's principal to a UPN via /users/{principalId}

Parameters

Days

Maximum number of days until expiry.

Property	Value
Required	false
Default Value	30
Type	Int32
Portal display name	Maximum days before expiry

Back to Runbook Reference overview