我有办法了。在通过浏览器Developer Tools调查了Portal正在进行的调用之后，我看到了以下内容：

https://api.azrbac.mspim.azure.com/api/v2/privilegedAccess/azureResources/roleAssignments/exportWithChildren

来自门户的该调用返回一个包含所请求数据的CSV。然而，我构建了以下函数，给予您选择输出到CSV或只是利用脚本中的数据：

function Set-HeaderWithToken {
    $pimtoken = Get-AzAccessToken -ResourceUrl '01fc33a7-78ba-4d2f-a4b7-768e336e890e' <#MS-PIM#> -ErrorAction Stop
    $headers = @{
        "Authorization" = "Bearer {0}" -f ($pimtoken.Token)
    }
    return $headers
}

function Query-PIMObjectWithChildren {
    #Returns PIM objects for both Azure Resource and AAD roles. If you pass aadRoles for the $roleType param, you do not need to specify $resourceIdentifier as it will default to the tenant ID needed for that call, since there's only one call to make for the AAD roles.
    param(
        [Parameter(Mandatory)]
        $header,
        [Parameter(Mandatory)]
        [ValidateSet("azureResources", "aadRoles")] #Passed parameter can only be one of these two options
        [string] $roleType,
        [string] $resourceIdentifier,
        [Parameter(Mandatory)]
        [ValidateSet("yes", "no")] #Passed parameter can only be one of these two options
        [string] $outputToCSV,
        [string] $subName
    )

    if ($roleType -eq "aadRoles") {
        $resourceIdentifier = "<tenant id>"
        $subName = "Tenant"
        $APIUri = "https://api.azrbac.mspim.azure.com/api/v2/privilegedAccess/aadRoles/roleAssignments/exportWithChildren"
    }
    elseif ($roleType -eq "azureResources") {
        $APIUri = "https://api.azrbac.mspim.azure.com/api/v2/privilegedAccess/azureResources/roleAssignments/exportWithChildren"
    }

    $parameters = @{
        '$expand' = 'subject,roleDefinition($expand=resource)'
        '$filter' = "(roleDefinition/resource/id eq '$resourceIdentifier')"
    }

    if ($outputToCSV -eq "yes") {
        Invoke-WebRequest -Headers $header -Uri $APIUri  -Method Get -Body $parameters -OutFile "C://Output.csv"
    }
    elseif ($outputToCSV -eq "no") {
        $result = Invoke-WebRequest -Headers $header -Uri $APIUri  -Method Get -Body $parameters -UseBasicParsing

        #Decode the raw result data as UTF-8 and skip the BOM (2 BOMs)
        $stringDecoded = [Text.Encoding]::UTF8.GetString($result.RawContentStream.ToArray()).Substring(2)

        #Now that it is decoded properly, we can convert to PSObjects
        $properResult = $stringDecoded | ConvertFrom-Csv

        return $properResult
    }
}

#Grab token and set header
$header = Set-HeaderWithToken

<# Need to have a list of subs and the id of them for the below to work.
foreach ($sub in $subscriptionList){

    $subPIMId = (Get-AzureADMSPriviliegedResource -ProviderId 'AzureResources' -Filter "ExternalId eq //subscriptions/$subscriptionId/'").Id
}
#>

$finalResult = Query-PIMObjectWithChildren -header $header -roleType azureResources -resourceIdentifier "xxxxx-xxx-xxxx-xxxx-xxxxxxxxxxx" -outputToCSV no

上面用于“Query-PIMOObjectWithChildren”函数/ API调用的-resourceIdentitfier开关是资源的PIM特定ID。为了澄清，这是不是你习惯使用的ID。IE，如果你试图拉订阅的数据，它不是订阅ID.
您可以通过以下两种方式之一来查找正确的ID：

1. Azure资源门户中的PIM刀片。选择您的资源，然后记下URL中的ID：
   

1.使用Get-AzureADMSourceResource命令查找ID。示例如下：
$subPIMId = (Get-AzureADMSPriviliegedResource -ProviderId 'AzureResources' -Filter "ExternalId eq //subscriptions/$subscriptionId/'").Id

• 注意：上面的订阅ID是您用来处理的真实subID。然后，可以将上述命令的输出（我正在访问.ID属性）输入-resourceIdentifier交换机，以生成PIM数据及其下的所有子节点。

最后一点注意，同样的事情也可以用于获取所有AAD角色分配。虽然它只是在租户级别，所以它不像Azure RBAC端对我那么有帮助，因为AAD角色的数据可以通过其他方式生成。
希望你说得通。任何人看到这个，让我知道如果你有任何问题，很乐意帮助。