I’m making a PowerShell call that retrieves an array of objects within Microsoft.Graph.Identity.Governance. These objects have StartDateTime and EndDateTime values but they’re nested within a ScheduleInfo property, which requires multiple expansions to reach them. Can someone help me with syntax to retrieve these values, given the details below?

Background: Privileged Identity Management (PIM) for Groups in Microsoft Entra can be used to add/remove M365 group members in a time-based capacity for time-based workflows. (This is an offshoot of the original PIM for Azure-based Roles, and so there are some cool use cases possible here). There is an eligible layer and an active layer; we are only concerned with the active layer for our scope. When a member is actively assigned, this is tracked as a running history. PowerShell support for this feature set is evolving, and there are different modules in play and limited methods to pick and choose from.

Details:

We can store the Active assignment history for a known Microsoft.Graph user and group using Microsoft.Graph.Identity.Governance:

$Group = get-mggroup -Filter "DisplayName eq 'TEST-PIM-Group'"
$user = get-mguser -UserId [email protected]

$assigns=@(Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest `
-Filter "groupId eq '$($Group.Id)' and principalId eq '$($user.Id)' and accessId eq 'member'")

Output might look like this:

$assigns | select Action, CompletedDateTime, Justification, ScheduleInfo

Action      CompletedDateTime   Justification     ScheduleInfo
------      -----------------   -------------     ------------
adminAssign 5/1/2024 4:47:41 PM Assigned on 5/1   Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequestSchedule
adminAssign 5/6/2024 1:14:33 PM Reassigned on 5/6 Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequestSchedule

Now the fun: To retrieve StartDateTime for the first entry we can expand the ScheduleInfo property:

$assigns[0] | select -ExpandProperty ScheduleInfo | fl

Expiration           : Microsoft.Graph.PowerShell.Models.MicrosoftGraphExpirationPattern
Recurrence           : Microsoft.Graph.PowerShell.Models.MicrosoftGraphPatternedRecurrence
StartDateTime        : 5/1/2024 4:47:41 PM
AdditionalProperties : {}

…but to retrieve the EndDateTime, we need to expand the nested Expiration:

$assigns[0] | select -ExpandProperty ScheduleInfo | select -ExpandProperty Expiration

EndDateTime          Type
-----------          ----
5/5/2024 10:00:00 PM afterDateTime

Final ask:

I know the last two custom expressions aren’t correct, but everything else here would work: Is there any way to retrieve the StartDateTime and EndDateTime along these lines?

$assigns | 
ForEach-Object {
  [pscustomobject]@{
      Group             = $group.DisplayName
      User              = $user.UserPrincipalName
      Action            = $_.Action
      CompletedDateTime = $_.CompletedDateTime
      Justification     = $_.Justification
      StartDateTime     = @{Name='StartDateTime';Expression={ select -expandProperty $_.ScheduleInfo | select StartDateTime }}
      EndDateTime       = @{Name='EndDateTime';Expression={ select -expandProperty $_.ScheduleInfo | select StartDateTime | select -ExpandProperty Expiration | select EndDateTime }}
    }
}