microsoftgraph / microsoftgraph/msgraph-sdk-powershell
New-MgIdentityGovernanceAccessReviewDefinitionInstance is not functional
@timayabi2020 is already working on this.
Since Oct 24, 2024.
- Dominant language
- C#
- Stars
- 898
- Forks
- 230
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 31
Description
Describe the bug
I have a requirement to create access reviews, occasionally out of schedule.
I would like these instances to be part of the same definition so that all the audit data is kept under the same access review.
I'm attempting to use either the Update-MgIdentityGovernanceAccessReviewDefinition (also see issue https://github.com/microsoftgraph/msgraph-metadata/issues/501)
or New-MgIdentityGovernanceAccessReviewDefinitionInstance command, but having no luck.
It appears that updating a definition will only update the end date and not the start date, of my reoccurring quarterly schedule, even after the current instance has ended. This is also the case if I use a one time schedule.
New-MgIdentityGovernanceAccessReviewDefinitionInstance also does not appear to be functional and throws errors also and when looking at the endpoints in the API documentation here: https://learn.microsoft.com/en-us/graph/api/resources/accessreviewinstance?view=graph-rest-1.0
I see no reference to any POST/Create activity for the instance endpoint.
New-MgIdentityGovernanceAccessReviewDefinitionInstance : {"Message":"No HTTP resource was found that matches the request URI 'https://api.accessreviews.identitygovernance.azure.com/accessReviews/v2.0/definitions('<accessReviewID>')/instances?ring=2'."}
Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2023-11-14T21:33:12
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : <RequestID>
client-request-id : <ClientRequestID>
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"005","RoleInstance":"<RoleInstance>"}}
Date : Tue, 14 Nov 2023 21:33:12 GMT
At line:1 char:1
+ New-MgIdentityGovernanceAccessReviewDefinitionInstance -AccessReviewS ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ AccessReviewS...eviewInstance }:<>f__AnonymousType299`2) [New-MgIdentityG...Instance_Create], Exception
+ FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.NewMgIdentityGovernanceAccessReviewDefinitionInstance_Create
To Reproduce
$params = @{
displayName = "AccessReview Test"
descriptionForAdmins = "Test"
descriptionForReviewers = "Test"
scope = @{
"@odata.type" = "#microsoft.graph.accessReviewQueryScope"
query = "/groups/<GroupID>/transitiveMembers"
queryType = "MicrosoftGraph"
}
reviewers = @(
@{
query = "/users/<UserID>"
queryType = "MicrosoftGraph"
}
)
settings = @{
mailNotificationsEnabled = $false
reminderNotificationsEnabled = $false
justificationRequiredOnApproval = $false
defaultDecisionEnabled = $true
defaultDecision = "Deny"
autoApplyDecisionsEnabled = $false
instanceDurationInDays = 2
recommendationsEnabled = $false
recurrence = @{
range = @{
type = "endDate"
startDate = (get-date).AddDays(3).tostring('yyyy-MM-dd')
endDate = (get-date).AddDays(5).tostring('yyyy-MM-dd')
}
}
}
}
New-MgIdentityGovernanceAccessReviewDefinitionInstance -AccessReviewScheduleDefinitionId "<AccessReviewID>" -BodyParameter $params
Expected behavior
To be able to either update an existing definition schedule, or instance schedule, or to create a new instance with customised schedule
Module Version
2.9.0
Environment Data
PSVersion 7.2.16
Additional context
I think this module needs a full review & testing properly as there seems to be lots of issues with the identity governance module.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.