microsoftgraph / microsoftgraph/msgraph-metadata

New-MgPrivilegedAccessRoleAssignmentRequest : The role assignment request is invalid

Open
#235 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
XSLT
Stars
166
Forks
55
Avg merge
16h 12m
Merged PRs (30d)
14

Description

Hello,
I want to assign an Azure role PIM to a resource, with MgGraph PowerShell module.
I have all the Ids from my backup.

It works with AzureAD module, with the cmdlet :
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId AzureResources -Schedule $schedule -ResourceId $assignement.ResourceId -RoleDefinitionId $assignement.RoleDefinitionId -SubjectId $assignement.SubjectId -AssignmentState "Eligible" -Type "AdminAdd"

But I try the cmdlet New-MgPrivilegedAccessRoleAssignmentRequest.

Params :

$params = @{
  RoleDefinitionId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  ResourceId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  SubjectId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  AssignmentState = "Eligible"
  Type = "AdminAdd"
  Reason = "Assign an eligible role"
  Schedule = @{
    StartDateTime = Get-Date
    Expiration = @{
      Type = "noExpiration"
    }
  }
}

New-MgPrivilegedAccessRoleAssignmentRequest -PrivilegedAccessId AzureResources -BodyParameter $params

But at the end, I have :
New-MgPrivilegedAccessRoleAssignmentRequest_Create: The role assignment request is invalid.

Did I forget something ?
Thanks a lot !

Full debug log :

DEBUG: [CmdletBeginProcessing]: - New-MgPrivilegedAccessRoleAssignmentRequest begin processing with parameterSet 'Create'.
DEBUG: [Authentication]: - AuthType: 'Delegated', AuthProviderType: 'InteractiveAuthenticationProvider', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph PowerShell'.
DEBUG: [Authentication]: - Scopes: [Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, Directory.Read.All, Domain.Read.All, Group.Read.All, openid, Policy.Read.All, Policy.Read.ConditionalAccess, Policy.ReadWrite.ConditionalAccess, PrivilegedAccess.Read.AzureAD, PrivilegedAccess.Read.AzureADGroup, PrivilegedAccess.Read.AzureResources, PrivilegedAccess.ReadWrite.AzureResources, profile, RoleAssignmentSchedule.Read.Directory, RoleEligibilitySchedule.Read.Directory, RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.Read.All, RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory, User.Read, email].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.microsoft.com/beta/privilegedAccess/AzureResources/roleAssignmentRequests

Headers:
FeatureFlag                   : 00000047
Cache-Control                 : no-store, no-cache
SdkVersion                    : graph-powershell/1.18.0,Graph-dotnet-1.25.1
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.22621; fr-CA),PowerShell/7.3.1
Accept-Encoding               : gzip

Body:
{
  "type": "AdminAdd",
  "assignmentState": "Eligible",
  "reason": "Assign an eligible role",
  "resourceId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "roleDefinitionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "subjectId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "schedule": {
    "Expiration": {
      "Type": "noExpiration"
    }
  }
}


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 92964870-86fd-4766-a025-30027d7b71f8
client-request-id             : 92964870-86fd-4766-a025-30027d7b71f8
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"Canada East","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"QB1PEPF0000291B"}}
Date                          : Tue, 20 Dec 2022 21:04:31 GMT

Body:
{
  "error": {
    "code": "InvalidRoleAssignmentRequest",
    "message": "The role assignment request is invalid.",
    "innerError": {
      "date": "2022-12-20T21:04:31",
      "request-id": "92964870-86fd-4766-a025-30027d7b71f8",
      "client-request-id": "92964870-86fd-4766-a025-30027d7b71f8"
    }
  }
}


New-MgPrivilegedAccessRoleAssignmentRequest_Create: The role assignment request is invalid.
DEBUG: [CmdletEndProcessing]: - New-MgPrivilegedAccessRoleAssignmentRequest end processing.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No repository file or test is named. Start by reproducing the POST to the beta privilegedAccess/AzureResources/roleAssignmentRequests endpoint with the supplied parameters, then compare it with the working AzureAD cmdlet and the Graph API contract. Done means identifying the invalid request field or prerequisite and documenting a confirmed correction or service-side issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
api, authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.