PIM Me
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@PIM MeActivate my quick roles for debugging production issue"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
PIM Me
Azure PIM role activation library and MCP server. Activate roles programmatically or through natural language with your AI assistant. Save your frequently-used roles as favorites and activate them all with a single command.
Quick Start
Prerequisites
Node.js 18+
Azure CLI installed and logged in (
az login)Azure account with PIM-eligible roles
As an MCP Server
Add to your MCP client:
VS Code (.vscode/mcp.json):
{
"servers": {
"pim-me": {
"command": "npx",
"args": ["-y", "pim-me-mcp"]
}
}
}Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"pim-me": {
"command": "npx",
"args": ["-y", "pim-me-mcp"]
}
}
}As a Library
npm install pim-me-mcpimport {
listEligibleRoles,
listActiveRoles,
activateRoles,
activateQuickRoles
} from 'pim-me-mcp';
// List all roles you can activate
const eligible = await listEligibleRoles();
console.log(eligible.roles);
// Check what's currently elevated
const active = await listActiveRoles();
active.roles.forEach(role => {
console.log(`${role.roleName} expires at ${role.endDateTime}`);
});
// Activate specific roles
const result = await activateRoles(
[{ name: 'Contributor', scope: 'my-subscription' }],
'Development work',
8 // hours
);
// Or activate your saved favorites
const quickResult = await activateQuickRoles('Development work');Related MCP server: cloudscope-mcp
MCP Server Usage
Setting Up Quick Roles
The easiest way to use this tool is to set up your frequently-used roles once:
Ask: "Show me my PIM roles" or "Help me set up my quick roles"
Pick roles from the numbered list: "Save roles 20, 21, 22 as my quick roles"
Set a default justification (optional): Include
defaultJustification: "Development work"when saving
Your configuration is saved to ~/.pim-me-mcp.json:
{
"quickRoles": {
"roles": [
{ "name": "Owner", "scope": "my-resource-group" },
{ "name": "Contributor", "scope": "my-subscription" }
],
"description": "My daily development roles",
"defaultJustification": "Development work"
}
}Daily Usage
Once configured, just say:
"Activate my quick roles" — uses your default justification
"Activate my quick roles for debugging production issue" — custom justification
"List my eligible roles" — see all roles you can activate
"List my active roles" — see currently elevated roles with expiration times
"Activate the Contributor role for my-subscription" — activate specific roles
Available Tools (MCP)
Tool | Description |
| Lists all PIM roles you can activate |
| Lists currently elevated roles with expiration times |
| Shows eligible roles with indices + your saved quick roles |
| Saves selected roles (by index) as quick roles |
| Activates your saved quick roles |
| Activates specific roles by name |
Library API
Core Functions
Function | Description |
| Returns all PIM roles you can activate |
| Returns currently elevated roles with expiration times |
| Activates specific roles |
| Activates your saved favorites |
Configuration Functions
Function | Description |
| Loads quick roles from config file or env |
| Saves quick roles to config |
| Returns path to |
Types
interface RoleConfig {
name: string; // e.g., "Contributor"
scope: string; // e.g., "my-subscription"
}
interface QuickRolesConfig {
roles: RoleConfig[];
description?: string;
defaultJustification?: string;
}How It Works
This MCP server uses the Azure CLI to interact with the Azure PIM REST API:
Lists eligible roles via
roleEligibilityScheduleInstancesAPILists active roles via
roleAssignmentScheduleInstancesAPI (filtered toassignmentType=Activated)Activates roles via
roleAssignmentScheduleRequestsAPI withSelfActivaterequest type
API Version: 2020-10-01
Tricky Implementation Details
🔑 Group-Based Role Assignments
The trickiest part of Azure PIM automation is handling group-based role assignments. When a role is assigned to a group (rather than directly to a user), activation requires special handling.
Problem 1: Wrong Principal ID
Symptom: "InsufficientPermissions" or "The assignee cannot be found"
Cause: The roleEligibilityScheduleInstances API returns the group's principal ID, but the activation API needs the user's principal ID.
Solution: Extract the user's OID from the Azure access token JWT:
async function getCurrentUserPrincipalId(): Promise<string> {
const tokenResult = await azCommand(
"account get-access-token --resource https://management.azure.com"
);
const tokenData = JSON.parse(tokenResult);
// Decode JWT payload (base64)
const payload = JSON.parse(
Buffer.from(tokenData.accessToken.split('.')[1], 'base64').toString()
);
return payload.oid; // The user's Azure AD Object ID
}Problem 2: Missing Linked Schedule ID
Symptom: Activation fails for group-based roles even with correct principal ID
Solution: For group-based assignments, include linkedRoleEligibilityScheduleId in the request body. This links the activation back to the group's eligibility schedule.
📦 Activation Request Body
{
"properties": {
"principalId": "<user-oid>",
"roleDefinitionId": "<role-definition-id>",
"requestType": "SelfActivate",
"justification": "<business-justification>",
"scheduleInfo": {
"expiration": {
"type": "AfterDuration",
"duration": "PT8H"
}
},
"linkedRoleEligibilityScheduleId": "<eligibility-schedule-id>"
}
}Note:
linkedRoleEligibilityScheduleIdis required for group-based assignments, optional for direct assignments.
⚠️ Error Handling
Error Code | Meaning | Solution |
| Role already activated | Treat as success ✅ |
| Wrong principal ID | Use user's OID, not group's |
| Principal ID mismatch | Extract OID from access token |
📋 API Reference
Endpoint | Method | Purpose |
| GET | List eligible roles |
| GET | List active roles |
| PUT | Activate a role |
Troubleshooting
Issue | Solution |
"Command 'az' not found" | |
"Please run 'az login'" | Run |
Role not found | Use |
License
MIT
Available Tools
6 toolsactivate_pim_rolesB
Activates specified PIM (Privileged Identity Management) roles in Azure. Provide role names and scopes to match against your eligible roles.
| Name | Required | Description | Default |
|---|---|---|---|
| roles | Yes | Array of role names to activate. These should match the role names shown in the Azure PIM portal. | |
| duration | No | Duration in hours for the role activation. Default is 8 hours. | |
| justification | Yes | The business justification for activating these roles. This is required by Azure PIM. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool activates roles but doesn't disclose important behavioral traits: whether activation is immediate, whether it checks eligibility first, what happens on failure, or whether it requires approval. The phrase 'match against your eligible roles' hints at validation behavior but doesn't explain the consequences of mismatches or partial failures.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core action and resource. It's concise and to the point, with no wasted words. The second sentence adds useful context about matching eligible roles. It could be slightly more structured by separating the usage guidance, but overall it's efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is incomplete. It doesn't explain what happens after activation (e.g., confirmation, errors, approval workflows), how scopes are specified, or how this differs from activate_quick_roles. The sibling list includes activate_quick_roles, which likely overlaps in functionality, and the description doesn't help an agent choose between them. The tool has 3 parameters and 2 required, so more behavioral context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters. The description adds minimal value beyond the schema: it mentions 'role names and scopes' but the schema only has a 'roles' array and no explicit 'scopes' parameter. This creates slight ambiguity about whether scopes are embedded in role names or a separate concept. The description doesn't clarify the 'duration' or 'justification' parameters beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool activates specified PIM roles in Azure, with a specific verb ('activates') and resource ('PIM roles'). It distinguishes itself from sibling tools like list_eligible_roles by focusing on activation, though it doesn't explicitly name alternatives. The mention of 'match against your eligible roles' adds useful context about how the tool works.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: provide role names and scopes to match eligible roles. It doesn't explicitly state when to use this tool versus alternatives like activate_quick_roles, which appears to be a sibling that also activates roles. The lack of explicit when/when-not guidance leaves some ambiguity, but the description does convey the core usage pattern.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
activate_quick_rolesA
Activates your saved quick roles (favorites) for fast elevation. Configure your quick roles first using list_quick_roles and save_quick_roles. Reads the latest config each time, so no server reload needed after changes.
| Name | Required | Description | Default |
|---|---|---|---|
| duration | No | Duration in hours for the role activation. Default is 8 hours. | |
| justification | No | The business justification for activating these roles. Optional if a default justification is configured. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It adds useful context by noting that the tool 'Reads the latest config each time' and requires no server reload. However, it does not disclose side effects beyond activation, such as permission requirements, audit implications, or what happens when no quick roles are configured.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short, purposeful sentences with no filler. The core action and purpose are front-loaded, followed by prerequisite setup and a useful configuration note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with two optional parameters and no output schema, the description provides the essential setup context and behavioral note. It is sufficient for an agent to invoke the tool correctly, though it could mention the no-roles-configured edge case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description does not add parameter-specific meaning beyond the schema. The baseline of 3 applies because the schema already documents duration and justification clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Activates'), a specific resource ('your saved quick roles (favorites)'), and the purpose ('for fast elevation'). It is distinguishable from activate_pim_roles by focusing on saved favorites, though it does not explicitly contrast itself with that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear setup context: configure quick roles first using list_quick_roles and save_quick_roles. It also explains the dynamic-config behavior, but it does not state explicit conditions for choosing this over activate_pim_roles or other siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_active_rolesA
Lists all currently active (elevated) PIM role assignments. Shows which roles you have activated, along with their start and end times.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the disclosure burden. It transparently states the operation is read-only ('Lists') and specifies the returned information (start and end times). It does not mention any side effects, but for a listing operation this is sufficient. It also implicitly communicates the elevation/security context, but does not detail permissions or limitations, which is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise, front-loaded sentences. The first sentence names the exact purpose, and the second expands on output details. No unnecessary words or redundancy, making it efficient and easy for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless listing tool with no output schema, the description is largely complete. It specifies what is listed and the included fields (start and end times). It does not mention potential nuances like ordering, scope (e.g., only the user's own activations), or any prerequisites, but these are not critical for a straightforward list operation. The sibling context suggests some differentiation could be helpful, but it is not strictly required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema covers everything (100%). The description adds value by explaining what the tool returns (active PIM roles with timing). Since there are no parameters to document, the baseline of 4 applies, and the description does not need to add further parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Lists') and resource ('currently active (elevated) PIM role assignments'), and adds detail on the output (roles activated with start/end times). It distinguishes itself from siblings by its focus on active PIM roles, contrasting with list_eligible_roles (eligible not active) and list_quick_roles (quick roles, not PIM).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (when you need currently activated PIM roles) but does not explicitly name alternatives or exclusion criteria. It lacks a direct statement like 'Use this instead of list_eligible_roles when you want only elevated roles you've activated.' For a tool surrounded by similar list/activation siblings, this guidance is not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_eligible_rolesA
Lists all eligible PIM (Privileged Identity Management) roles that can be activated in Azure. Returns role names, scopes, and whether they are assigned directly or through a group.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It clearly signals a read-only listing ('Lists', 'Returns') and specifies the returned attributes (role names, scopes, assignment type). It does not discuss auth or rate limits, but for a parameterless list operation that is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with the core action front-loaded and the return shape provided in the second sentence. No filler, repetition, or irrelevant detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only list with no output schema, the description covers the action, scope, and return fields completely. An agent has enough information to invoke the tool and interpret its result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty schema, so there is nothing semantic to add; the baseline 4 applies. The description correctly avoids inventing or describing parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb ('Lists') and a specific resource ('eligible PIM roles that can be activated in Azure'), and names the returned attributes. This clearly distinguishes it from siblings like list_active_roles, which would cover active rather than eligible roles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied by 'eligible ... that can be activated': an agent would call this before activating a role. However, the description never names alternatives such as list_active_roles or activate_pim_roles, nor states conditions for when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_quick_rolesA
Lists all eligible PIM roles with indices and shows your currently saved quick roles. Use this to see available roles, then call save_quick_roles with your selected indices to update your favorites.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. The verbs 'Lists' and 'shows' clearly imply a read-only operation, and the mention of providing indices indicates the tool surfaces data meant for the save_quick_roles workflow. However, it does not explicitly state there are no side effects, nor does it describe the output format or pagination if any.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each earning its place. The first sentence states the tool's output, and the second explains the workflow. No filler or repetition of schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a parameterless, read-only list tool. It explains what will be shown and what the caller should do with the results. The only gap is not clarifying the difference from the similarly named list_eligible_roles sibling, which could lead an agent to pick the wrong tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema leaves nothing ambiguous. The description adds relevant context about what the returned indices are used for (selecting quick roles), but with no parameters to document, the baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Lists all eligible PIM roles with indices and shows your currently saved quick roles' – a specific verb and resource. It differentiates itself by mentioning both eligible roles and saved quick roles, but the existence of sibling list_eligible_roles creates some ambiguity about the exact boundary between the two tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit workflow guidance: 'Use this to see available roles, then call save_quick_roles with your selected indices to update your favorites.' This tells the agent when to invoke the tool and what to do next. However, it does not explicitly state when not to use it or how it compares to other siblings like list_eligible_roles or activate_quick_roles.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_quick_rolesA
Saves your selected roles as quick roles for fast activation. Use the indices from list_quick_roles to specify which roles to save.
| Name | Required | Description | Default |
|---|---|---|---|
| indices | Yes | Array of role indices from list_quick_roles to save as your quick roles. | |
| description | No | Optional description for your quick roles set (e.g., 'My daily development roles'). | |
| defaultJustification | No | Optional default justification to use when activating quick roles (e.g., 'Development work'). If set, you won't need to provide a justification each time. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It explains the purpose but does not mention side effects, whether existing quick roles are overwritten, permission requirements, or what happens after saving. This is a notable gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no wasted words. The key action and the required input source are front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description and schema together define the parameters well, but with no annotations and no output schema, the tool lacks behavioral context such as overwrite behavior, return value, or next steps. It is adequate for a basic save operation but leaves some operational ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each parameter already has a meaningful description. The tool description adds helpful context by pointing to list_quick_roles as the source of indices, but it doesn't add new details for the optional description or defaultJustification parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool saves selected roles as quick roles for fast activation, using a specific verb and resource. It distinguishes itself from siblings like activate_quick_roles by indicating this is a save operation, not activation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: use indices from list_quick_roles to specify which roles to save. It doesn't explicitly exclude alternatives or state when not to use the tool, but the instruction is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.2.1- First observed
activate_pim_roles - First observed
activate_quick_roles - First observed
list_active_roles - First observed
list_eligible_roles - First observed
list_quick_roles - First observed
save_quick_roles
TDQS
Scored across 6 tools
list_eligible_roles and list_quick_roles overlap significantly by both listing eligible roles, though list_quick_roles adds indices and saved quick-role info. activate_quick_roles and activate_pim_roles are distinct in purpose but could still be confused at a glance.
All tool names follow a consistent snake_case verb_noun pattern, starting with list, activate, or save. The naming clearly communicates the action and target object without mixing conventions.
With 6 tools, the server is well-scoped for a focused PIM role activation workflow. Each tool serves a recognizable function within the quick-role and direct-activation flows.
The set covers listing eligible roles, activating roles, quick-role management, and listing active roles, but lacks a deactivate or end-role operation. This creates a dead end for users who want to manually end an elevation early.
Maintenance
Related MCP Connectors
Official Microsoft MCP Server to query Microsoft Entra data using natural language
The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Related MCP Servers
- AlicenseBqualityAmaintenanceAn MCP server that enables running CLI for Microsoft 365 commands through GitHub Copilot Agent, allowing users to interact with Microsoft 365 services using natural language.4950 npm133MIT
- AlicenseAqualityBmaintenanceCloud cost management MCP server for Azure. Ask your AI about your cloud bill.1535 npm1MIT
- AlicenseAqualityDmaintenanceAn MCP server for Azure development and operations, enabling Cosmos DB queries, Service Bus messaging, and PIM role activation.31MIT
- AlicenseBqualityCmaintenanceAn MCP server for managing Azure infrastructure from AI assistants, supporting subscriptions, VMs, storage, networking, identity, and more through natural language commands.992MIT