Azure / Azure/azure-powershell

New-AzRoleAssignmentScheduleRequest cmdlet does not work when a PIM eligible role assignment has Conditional Access authentication context enabled

Open
#25,421 6 comments 1 reaction 0 assignees View on GitHub
act-identity-squad Authorization customer-reported question Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

I am able to get the New-AzRoleAssignmentScheduleRequest to work on some PIM eligible assignments, however I noticed I get an error message when trying this on eligible assignments that have the Conditional Access authentication context setting enabled. Is there any way to get around this?

### Script or Debug output

_No response_

### Environment data

_No response_

### Module versions

```PowerShell
Az.Resources 5.6.0
```

### Error output

```PowerShell
New-AzRoleAssignmentScheduleRequest : &claims=%7B%22access_token%22%3A%7B%22acrs%22%3A%7B%22essential%22%3Atrue%2C%20%22value%22%3A%22c1%22%7D%7D%7D
At line:21 char:1
+ New-AzRoleAssignmentScheduleRequest -Name $guid -Scope $scope -Expira ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ Scope = /subs...heduleRequest }:<>f__AnonymousType53) [New-AzRoleAssig..._CreateExpanded], Exception
+ FullyQualifiedErrorId : RoleAssignmentRequestAcrsValidationFailed,Microsoft.Azure.PowerShell.Cmdlets.Resources.Authorization.Cmdlets.NewAzRoleAssignmentScheduleRequest_CreateExpanded
```

Contributor guide

Open the contributing guide

Research direction

Start at the New-AzRoleAssignmentScheduleRequest cmdlet and reproduce the RoleAssignmentRequestAcrsValidationFailed error with an eligible assignment that has Conditional Access authentication context enabled. Trace how the cmdlet handles that request, then verify that the same Az.Resources 5.6.0 scenario no longer fails and add regression coverage if the project’s existing tests support it.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
authentication, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.