I'm currently assisting a team that's automating Azure PIM role activations for their Datadog service accounts. They're using the Microsoft Graph API, specifically the `roleEligibilityScheduleRequests` endpoint, to activate eligible assignments. The API call returns a `201 Created` response, indicating the request was accepted, but the role never becomes active. The eligible assignment remains in an eligible state.
We've ruled out the obvious: the service principal has the `Privileged Role Administrator` role, MFA is not required for these service accounts, and the scope (subscription) is correct. The request payload appears standard:
```json
{
"action": "selfActivate",
"principalId": "",
"roleDefinitionId": "",
"directoryScopeId": "/subscriptions/",
"justification": "Automated deployment for monitoring pipeline",
"scheduleInfo": {
"startDateTime": "2024-01-15T10:00:00Z",
"expiration": {
"type": "afterDuration",
"duration": "PT8H"
}
}
}
```
The issue seems to be that the activation request is created but never transitions from `PendingApproval` or `PendingActivation` to `Active`. There's no approval required for these roles, and the ticket system integration is not configured. Has anyone successfully automated this flow for service principals and encountered a similar stall? I'm particularly interested in the exact permissions and app registrations required beyond the PIM administrator role, and whether there's a known latency or a required `roleAssignmentScheduleRequests` call that must follow.
null