microsoftgraph / microsoftgraph/msgraph-metadata
New-MgPrivilegedAccessRoleAssignmentRequest : The role assignment request is invalid
Nobody has claimed this yet.
- Dominant language
- XSLT
- Stars
- 166
- Forks
- 55
- Avg merge
- 16h 12m
- Merged PRs (30d)
- 14
Description
Hello,
I want to assign an Azure role PIM to a resource, with MgGraph PowerShell module.
I have all the Ids from my backup.
It works with AzureAD module, with the cmdlet :
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId AzureResources -Schedule $schedule -ResourceId $assignement.ResourceId -RoleDefinitionId $assignement.RoleDefinitionId -SubjectId $assignement.SubjectId -AssignmentState "Eligible" -Type "AdminAdd"
But I try the cmdlet New-MgPrivilegedAccessRoleAssignmentRequest.
Params :
$params = @{
RoleDefinitionId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
ResourceId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
SubjectId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
AssignmentState = "Eligible"
Type = "AdminAdd"
Reason = "Assign an eligible role"
Schedule = @{
StartDateTime = Get-Date
Expiration = @{
Type = "noExpiration"
}
}
}
New-MgPrivilegedAccessRoleAssignmentRequest -PrivilegedAccessId AzureResources -BodyParameter $params
But at the end, I have :
New-MgPrivilegedAccessRoleAssignmentRequest_Create: The role assignment request is invalid.
Did I forget something ?
Thanks a lot !
Full debug log :
DEBUG: [CmdletBeginProcessing]: - New-MgPrivilegedAccessRoleAssignmentRequest begin processing with parameterSet 'Create'.
DEBUG: [Authentication]: - AuthType: 'Delegated', AuthProviderType: 'InteractiveAuthenticationProvider', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph PowerShell'.
DEBUG: [Authentication]: - Scopes: [Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, Directory.Read.All, Domain.Read.All, Group.Read.All, openid, Policy.Read.All, Policy.Read.ConditionalAccess, Policy.ReadWrite.ConditionalAccess, PrivilegedAccess.Read.AzureAD, PrivilegedAccess.Read.AzureADGroup, PrivilegedAccess.Read.AzureResources, PrivilegedAccess.ReadWrite.AzureResources, profile, RoleAssignmentSchedule.Read.Directory, RoleEligibilitySchedule.Read.Directory, RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.Read.All, RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory, User.Read, email].
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
POST
Absolute Uri:
https://graph.microsoft.com/beta/privilegedAccess/AzureResources/roleAssignmentRequests
Headers:
FeatureFlag : 00000047
Cache-Control : no-store, no-cache
SdkVersion : graph-powershell/1.18.0,Graph-dotnet-1.25.1
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.22621; fr-CA),PowerShell/7.3.1
Accept-Encoding : gzip
Body:
{
"type": "AdminAdd",
"assignmentState": "Eligible",
"reason": "Assign an eligible role",
"resourceId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"roleDefinitionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"subjectId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"schedule": {
"Expiration": {
"Type": "noExpiration"
}
}
}
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
BadRequest
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 92964870-86fd-4766-a025-30027d7b71f8
client-request-id : 92964870-86fd-4766-a025-30027d7b71f8
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada East","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"QB1PEPF0000291B"}}
Date : Tue, 20 Dec 2022 21:04:31 GMT
Body:
{
"error": {
"code": "InvalidRoleAssignmentRequest",
"message": "The role assignment request is invalid.",
"innerError": {
"date": "2022-12-20T21:04:31",
"request-id": "92964870-86fd-4766-a025-30027d7b71f8",
"client-request-id": "92964870-86fd-4766-a025-30027d7b71f8"
}
}
}
New-MgPrivilegedAccessRoleAssignmentRequest_Create: The role assignment request is invalid.
DEBUG: [CmdletEndProcessing]: - New-MgPrivilegedAccessRoleAssignmentRequest end processing.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is named. Start by reproducing the POST to the beta privilegedAccess/AzureResources/roleAssignmentRequests endpoint with the supplied parameters, then compare it with the working AzureAD cmdlet and the Graph API contract. Done means identifying the invalid request field or prerequisite and documenting a confirmed correction or service-side issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- api, authorization, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100