Never Trust an AI Tool.
Always Verify. Always Enforce.

# PowerShell — Configure Azure PIM for Just-in-Time AI Tool Access
# Requires: Microsoft.Graph.Identity.Governance module

Import-Module Microsoft.Graph.Identity.Governance

# Define the eligible assignment for the AI Tools Access group
$params = @{
    "@odata.type"       = "#microsoft.graph.unifiedRoleEligibilityScheduleRequest"
    action              = "adminAssign"
    justification       = "Enable JIT access for AI Code Assistants tier"
    roleDefinitionId    = "grp-zt-ai-tier2-code-assistants"
    directoryScopeId    = "/"
    principalId         = "<user-object-id>"
    scheduleInfo        = @{
        startDateTime = "2026-01-01T00:00:00Z"
        expiration    = @{
            type     = "afterDuration"
            duration = "P90D"  # Eligible for 90 days, must reapply
        }
    }
}

New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest `
    -BodyParameter $params

# Configure the activation policy — what happens when user activates
$activationRules = @{
    "@odata.type" = "#microsoft.graph.unifiedRoleManagementPolicyRule"
    id = "Activation_MaxDuration"
    ruleType = "RoleManagementPolicyExpirationRule"
    target = @{ caller = "EndUser"; level = "Eligible" }
    maximumDuration = "PT4H"       # Max 4-hour activation window
    isExpirationRequired = $true  # Access auto-expires, no exceptions
}

$approvalRules = @{
    "@odata.type" = "#microsoft.graph.unifiedRoleManagementPolicyRule"
    id = "Activation_Approval"
    ruleType = "RoleManagementPolicyApprovalRule"
    target = @{ caller = "EndUser"; level = "Eligible" }
    setting = @{
        isApprovalRequired       = $true
        isApprovalRequiredForExtension = $true
        approvalMode             = "SingleStage"
        approvalStages           = @(
            @{
                approvalStageTimeOutInDays = 1
                primaryApprovers = @(
                    @{
                        "@odata.type" = "#microsoft.graph.groupMembers"
                        groupId = "grp-ai-access-approvers"
                        description = "Security team AI access approvers"
                    }
                )
            }
        )
    }
}

$mfaRule = @{
    "@odata.type" = "#microsoft.graph.unifiedRoleManagementPolicyRule"
    id = "Activation_MFA"
    ruleType = "RoleManagementPolicyAuthenticationContextRule"
    target = @{ caller = "EndUser"; level = "Eligible" }
    isEnabled = $true
    claimValue = "c1"  # Requires phishing-resistant MFA context
}

Write-Host "JIT AI access configured:"
Write-Host "  - Eligible for 90 days, must reapply after expiry"
Write-Host "  - Each activation limited to 4 hours maximum"
Write-Host "  - Requires security team approval within 24 hours"
Write-Host "  - Phishing-resistant MFA required at activation"