Azure / Azure/azure-powershell
New-AzRoleAssignmentScheduleRequest cmdlet does not work when a PIM eligible role assignment has Conditional Access authentication context enabled
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
I am able to get the New-AzRoleAssignmentScheduleRequest to work on some PIM eligible assignments, however I noticed I get an error message when trying this on eligible assignments that have the Conditional Access authentication context setting enabled. Is there any way to get around this?
### Script or Debug output
_No response_
### Environment data
_No response_
### Module versions
```PowerShell
Az.Resources 5.6.0
```
### Error output
```PowerShell
New-AzRoleAssignmentScheduleRequest : &claims=%7B%22access_token%22%3A%7B%22acrs%22%3A%7B%22essential%22%3Atrue%2C%20%22value%22%3A%22c1%22%7D%7D%7D
At line:21 char:1
+ New-AzRoleAssignmentScheduleRequest -Name $guid -Scope $scope -Expira ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ Scope = /subs...heduleRequest }:<>f__AnonymousType53) [New-AzRoleAssig..._CreateExpanded], Exception
+ FullyQualifiedErrorId : RoleAssignmentRequestAcrsValidationFailed,Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Cmdlets.NewAzRoleAssignmentScheduleRequest_CreateExpanded
```
Contributor guide
Research direction
Start at the New-AzRoleAssignmentScheduleRequest cmdlet and reproduce the RoleAssignmentRequestAcrsValidationFailed error with an eligible assignment that has Conditional Access authentication context enabled. Trace how the cmdlet handles that request, then verify that the same Az.Resources 5.6.0 scenario no longer fails and add regression coverage if the project’s existing tests support it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, powershell
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100