PIM Launcher
A PowerShell GUI that activates Entra ID PIM roles on customer tenants and opens the portals in a browser session that is already refreshed, with no more sign-outs or incognito windows.
What it does
After activating a role in PIM, tokens that have already been issued do not include it: to use it you have to sign out, refresh the session or open an incognito window, for every portal and every customer. PIM Launcher removes this friction. You pick the customer, tick the roles, activate them with a justification, duration and ticket, and the tool opens the customer’s portals in an Edge session where the role is already valid.
Architecture
A single PowerShell 7 script with a WPF interface and a JSON configuration file:
- PIM-Launcher.ps1 — WPF window (XAML layout embedded in the script) that connects to Microsoft Graph, reads the eligible roles, activates them and waits until they show as active
- tenants.json — customers, portals with URL templates and each customer’s Edge profile
Portals open in three modes: the customer’s Edge profile, a fresh isolated session, or InPrivate.
Tech stack
- PowerShell 7 — logic and interface
- WPF / XAML — GUI with no additional modules
- Microsoft Graph — eligible roles, active roles and activation requests (
Microsoft.Graph.Authentication) - Microsoft Edge — per-customer profiles and sessions
It runs on Windows only and handles Entra ID roles. The code, a sample configuration and the known limitations are in the repository.