New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest fails with "The following policy rules failed: ["MfaRule"]" error

We are seeing a consistent issue activating AAD PIM roles using the Microsoft Graph SDK PowerShell module (version 2.0.0-Preview4 and the issue is still present in the latest version 2.28.0 as of June 2025).

We are attempting to enable/activate a PIM role via Graph PowerShell module using the ‘New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest’ cmdlet. For some admins (but not all) the request fails with the following error:

Exception             : System.Exception: [RoleAssignmentRequestPolicyValidationFailed] : The following policy rules failed: ["MfaRule"]
TargetObject          : { body = Microsoft.Graph.PowerShell.Models.MicrosoftGraphUnifiedRoleAssignmentScheduleRequest }
CategoryInfo          : InvalidOperation: ({ body = Micros...heduleRequest }:<>f__AnonymousType33`1) [New-MgRoleManag...eRequest_Create], Exception
FullyQualifiedErrorId : RoleAssignmentRequestPolicyValidationFailed,Microsoft.Graph.PowerShell.Cmdlets.NewMgRoleManagementDirectoryRoleAssignmentScheduleRequest_Create
ErrorDetails          : The following policy rules failed: ["MfaRule"]
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest<Process>, C:\ProgramFiles\WindowsPowerShell\Modules\Microsoft.Graph.Identity.Governance\2.0.0\exports\ProxyCmdletDefinitions.ps1: line 38209 at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {}
PSMessageDetails      :
 

This is on Windows 10 with PowerShell 5.1. It also occurs on Windows 11. Our IDP is Okta.

When connecting to Graph via the Connect-MgGraph cmdlet, it does not prompt for MFA. It prompts to select the current user’s UPN and connects. Then when we try to activate a PIM role, we get the above error. For other users, it also doesn’t prompt for MFA when connecting to MgGraph, but the PIM role activation works fine. Almost like they already have an existing OAuth token cached, that satisfies the ‘MFArule’ claim.

Example code:

$TenantId = "12345678897687876658768768"
$ClientId = "sdfdsfdsfgdsgdsgdsgdsgdsgdsgdsgdsgfdhgfjhgf"
$UserPrincipalName = "ExampleUserUPN"
Connect-MgGraph -TenantId $TenantId -ClientId $ClientId
$tmpRoleDef = Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'Exchange Administrator'" -ErrorAction Stop
$tmpUserId = Get-MgUser -UserId $UserPrincipalName -ErrorAction Stop
$TicketNumber = ""
$TicketSystem = ""
$Duration = 2
$tmpStartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$tmpDuration = "PT" + $Duration + "H"
$Justification = "Testing PowerShell Graph API PIM Role enablement"
$tmpParams = @{
            Action = "selfActivate"
            PrincipalId = "$($tmpUserId.Id)"
            RoleDefinitionId = "$($tmpRoleDef.Id)"
            DirectoryScopeId = "/"
            Justification = "$Justification"
            ScheduleInfo = @{
                  StartDateTime = $tmpStartDateTime
                  Expiration = @{
                        Type = "AfterDuration"
                        Duration = "$tmpDuration"
                  }
            }
            TicketInfo = @{
                  TicketNumber = "$TicketNumber"
                  TicketSystem = "$TicketSystem"
            }
      }
 
$tmpRoleActivate = New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $tmpParams -ErrorAction Stop

If we use the MSAL.PS module to generate our own OAuth token with the ‘MFA’ claim, then we are prompted to authenticate via MFA as expected. And we can pass the OAuth token to Connect-MgGraph via the -AccessToken parameter, and the PIM role enablement works as intended. So that is a good work-around, but of course it means that the Graph connection will stop working after 60 mins since our OAuth token will expire. Unfortunately, the MSAL.PS module has been deprecated and is no longer actively maintained.

I couldn’t find a method to make the Connect-MgGraph cmdlet require MFA when getting an OAuth token, or to pass the "Require MFA" claim requirement.

Example code which used to work using MSAL.PS module to get our own OAuth token (no longer works as of June 2025):

msalToken = Get-MSALToken -Scopes @(https://graph.microsoft.com/.default) -ClientId $ClientId -RedirectUri http://localhost -Authority https://login.microsoftonline.com/$TenantId -Interactive -ExtraQueryParameters @{claims='{"access_token" : {"amr": { "values": ["mfa"] }}}'} -LoginHint $UserPrincipalName
 
Connect-MgGraph -AccessToken (ConvertTo-SecureString -String $($msalToken.AccessToken) -AsPlainText -Force)

Many thanks!

Riprodurre l'errore con New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest e il flusso di esempio Connect-MgGraph nelle versioni interessate di PowerShell e Microsoft Graph SDK. Iniziare dal percorso di autenticazione Connect-MgGraph e dall'entry point generato ProxyCmdletDefinitions.ps1, quindi confrontarlo con il flusso funzionante MSAL.PS -AccessToken. Il lavoro è completato quando gli amministratori interessati possono attivare il ruolo PIM tramite la connessione Graph PowerShell supportata soddisfacendo MfaRule.