Assign Microsoft Entra ID Access Packages on demand — from your terminal.
Pick a package, enter emails, add a justification, assign. One PowerShell command.
v1.0.2 · PowerShell 7.0+Everything you need to grant access package assignments, in one tool.
Assign one user or many at once. Enter addresses separated by commas, spaces, or semicolons — each is resolved and labeled inline.
Register the access packages this tool manages once. No browsing the directory on every run — just pick from your list.
Every email is checked and tagged before you commit: ready to assign, already has access, or not found.
Configurable canned justification options plus a custom free-text entry. Required on every assignment, never blank.
The assignment end date is computed from the policy's maximum duration automatically — no date prompts to fill in.
Detects orphaned "open request" errors, finds the blocking request, and offers to cancel and retry — no portal trip.
Browser-based MSAL authentication on Windows, macOS, and Linux. Full Conditional Access policy enforcement.
Optionally bring your own Entra app registration (Client ID / Tenant ID) for conditional access or tenant-scoped consent.
A cooling-off countdown lets assignments propagate through the directory, then the live assignments view refreshes automatically.
Sign in, configure packages, assign a user, and see it delivered in Entra.
Up and running in three commands.
Ten cmdlets cover the whole workflow.
| Cmdlet | Description |
|---|---|
Start-AccessPackageOnDemand | Launch the interactive TUI: auth → pick package → enter emails → justify → assign. |
Set-AccessPackageConfig | Add, remove, or replace the configured access packages. |
Get-AccessPackageConfig | List the access packages currently configured. |
Clear-AccessPackageConfig | Delete the saved configuration. |
Set-AccessPackageJustificationOptions | Set the canned business justification options. |
Get-AccessPackageJustificationOptions | Show the effective justification options. |
Clear-AccessPackageJustificationOptions | Revert to the built-in default justifications. |
Set-AppRegistrationConfig | Configure a custom Entra app registration for sign-in. |
Get-AppRegistrationConfig | Show the configured app registration, if any. |
Clear-AppRegistrationConfig | Revert to the default Microsoft public client. |
Delegated Microsoft Graph scopes and a directory role that can manage assignments.