lgosling/pim-activation repository overview

⁠PIM Activation Web

A web-based Privileged Identity Management (PIM) tool for Microsoft Entra ID, PIM-enabled groups, and Azure Resources. Built with Pode (PowerShell HTTP server) running in Docker, with Entra ID OAuth 2.0 authentication.

⁠Key Features

• Entra ID Roles — View and activate/deactivate directory roles with AU scope support
• PIM Groups — Manage PIM-enabled security group memberships (member/owner)
• Azure Resources — Activate/deactivate Azure subscription and resource roles
• Saved Profiles — Save role combinations and activate them with two clicks
• Activation History — History log with analytics and Entra audit log sync
• Dark/Light Theme — Auto, light, or dark mode with full color customization

⁠Quick Start

⁠1. Pull the image

docker pull lgosling/pim-activation

⁠2. Create a .env file

ENTRA_TENANT_ID=your-tenant-id.onmicrosoft.com
ENTRA_CLIENT_ID=your-app-client-id
ENTRA_CLIENT_SECRET=your-app-client-secret
ENTRA_REDIRECT_URI=https://{FQDN}/api/auth/callback

⁠3. Add TLS certificate

mkdir -p certs
# Copy your CA-signed certificate:
cp /path/to/cert.pem certs/cert.pem
cp /path/to/key.pem  certs/key.pem

⁠4. Run

docker run -d \
  --name pim-activation \
  --env-file .env \
  -v ./certs:/etc/pim-certs:ro \
  -v ./config:/etc/pim-config:ro \
  -v pim-data:/var/pim-data \
  -v ./logs:/var/log/pim:rw \
  -p 443:8080 \
  -p 80:8081 \
  --dns 8.8.8.8 --dns 8.8.4.4 \
  lgosling/pim-activation

Or use the docker-compose.yml from the GitHub repository⁠.

⁠5. Open the UI

Navigate to https://{FQDN} — you'll be redirected to Entra ID for authentication.

⁠Environment Variables

⁠DNS Note

This container uses Alpine Linux. Due to a musl libc DNS issue, you must provide external DNS servers (--dns 8.8.8.8 --dns 8.8.4.4) or use the provided docker-compose.yml. Without this, API calls to Microsoft Graph will fail.

⁠Documentation

Full documentation, app registration guide, and architecture details are available on GitHub⁠.

⁠License

MIT⁠