Azure / Azure/azure-powershell
New-AzRoleAssignment returns "'PrincipalId' cannot be null" when user's UPN != mail
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
If a user's AAD object has
UserPrincipalName = alias@domain.com
mail = first.last@domain.com
And you call New-AzRoleAssignment passing the -SignInName as their mail property, then the "'PrincipalId' cannot be null" error is thrown.
This is because NewAzRoleAssignmentCommand only populates the UPN property of the ADObjectFilterOptions. This means the FilterUsers function in ActiveDirectoryClient.cs will only set the Graph query filter to "u.UserPrincipalName == upnOrMail".
It would be better if FilterUsers would set the Graph query filter to "u.UserPrincipalName == upnOrMail || u.Mail == upnOrMail". Alternatively provide another parameter to New-AzRoleAssignment which would accept a user's Email address (and subsequently set the mail property of the ADObjectFilterOptions) instead of SignInName.
### Issue script & Debug output
```PowerShell
PS C:\Users\kwill> New-AzRoleAssignment -SignInName "First.Last@domain.com" -RoleDefinitionName Owner -Scope "/subscriptions/$SubId"
New-AzRoleAssignment : 'PrincipalId' cannot be null.
At line:1 char:1
+ New-AzRoleAssignment -SignInName "First.Last@microsoft.com" -Ro ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzRoleAssignment], ValidationException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Resources.NewAzureRoleAssignmentCommand
```
### Environment data
```PowerShell
PS C:\Users\kwill> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.22621.2506
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.22621.2506
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```
### Module versions
```PowerShell
PS C:\Users\kwill> Get-Module Az*
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 2.13.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}
Script 6.10.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}
Binary 2.0.2.149 AzureADPreview {Add-AzureADAdministrativeUnitMember, Add-AzureADApplicationOwner, Add-AzureADApplicationPolicy, Add-AzureADDeviceRegisteredOwner...}
```
### Error output
```PowerShell
Message : 'PrincipalId' cannot be null.
StackTrace : at Microsoft.Azure.Management.Authorization.Models.RoleAssignmentCreateParameters.Validate()
at Microsoft.Azure.Management.Authorization.RoleAssignmentsOperations.d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.Authorization.RoleAssignmentsOperationsExtensions.d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.Authorization.RoleAssignmentsOperationsExtensions.Create(IRoleAssignmentsOperations operations, String scope, String roleAssignmentName, RoleAssignmentCreateParameters parameters)
at Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient.CreateRoleAssignment(FilterRoleAssignmentsOptions parameters, Guid roleAssignmentId)
at Microsoft.Azure.Commands.Resources.NewAzureRoleAssignmentCommand.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception : Microsoft.Rest.ValidationException
InvocationInfo : {New-AzRoleAssignment}
Line : New-AzRoleAssignment -SignInName "First.Last@microsoft.com" -RoleDefinitionName Owner -Scope "/subscriptions/$SubId" -Debug
Position : At line:1 char:1
+ New-AzRoleAssignment -SignInName "First.Last@microsoft.com" -Ro ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 7
```
Contributor guide
Assessment
This issue has not been assessed yet.