microsoftgraph / microsoftgraph/msgraph-sdk-powershell
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition returns empty when filtering by DisplayName 'AccessPackage assignment manager' using eq logic
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 898
- Forks
- 230
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 31
Description
Describe the bug
I am attempting to filter entitlement management role definitions using the Microsoft Graph Beta PowerShell SDK. When utilizing the Get-MgBetaRoleManagementEntitlementManagementRoleDefinition cmdlet with an OData filter on the DisplayName property, using the equality operator (eq) fails silently and returns an empty result specifically for the built-in role "AccessPackage assignment manager".
This behavior is highly inconsistent and points to a localized parsing or backend API string-matching bug because:
- The role explicitly exists in the tenant. Running the cmdlet with no filters lists it clearly alongside other roles like "Catalog owner" and "Catalog reader".
- Querying by the direct ID (
Id eq 'e2182095-804a-4656-ae11-64734e9b7ae5') works perfectly and returns the item. - The OData equality filter (
eq) works perfectly fine for other roles retrieved in the exact same dataset, such asDisplayName eq 'Catalog owner'. - Using a string manipulation OData filter function like
startswith(displayName,'AccessPackage assignment manager')successfully evades the bug and returns the resource.
The exact matching evaluation breaks down solely when an absolute equality logic string match is forced against "AccessPackage assignment manager".
Expected behavior
When executing the command with an exact string equality filter matching a known role definition:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "DisplayName eq 'AccessPackage assignment manager'"
The underlying Graph API call should successfully evaluate the string and return the corresponding directory role definition object, matching the consistent behavior observed when performing equality filters against other default roles like 'Catalog owner'.
Specifically, it should return the following object output instead of an empty line:
DisplayName Id TemplateId Description IsBuiltIn
----------- -- ---------- ----------- ---------
AccessPackage assignment manager e2182095-804a-4656-ae11-64734e9b7ae5 e2182095-804a-4656-ae11-64734e9b7ae5 AccessPackage assignment manager True
How to reproduce
Execute the following steps in an authenticated Microsoft Graph PowerShell terminal session containing the Microsoft.Graph.Beta.Identity.Governance module:
- List all available roles to confirm presence and verify the literal string spacing of the target role name:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition
- Execute a control test using the
eqfilter on a different role to prove the query syntax and module filtering capabilities are functional:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "DisplayName eq 'Catalog owner'"
# Output: Returns the "Catalog owner" role definition object successfully.
- Query the target role directly by its ID to confirm it is valid, indexed, and fully accessible in the backend database:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "Id eq 'e2182095-804a-4656-ae11-64734e9b7ae5'"
# Output: Returns the "AccessPackage assignment manager" object successfully.
- Run a workaround query utilizing
startswithto demonstrate that partial string comparison functions evaluate the entry successfully:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "startswith(displayName,'AccessPackage assignment manager')"
# Output: Returns the "AccessPackage assignment manager" object successfully.
- Run the problematic query with absolute equality to observe the bug:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "DisplayName eq 'AccessPackage assignment manager'"
# Output: Returns absolutely nothing (Null/Empty response).
SDK Version
2.38.0
Latest version known to work for scenario above?
No response
Known Workarounds
No response
Debug output
Click to expand log
```DEBUG: [CmdletBeginProcessing]: - Get-MgBetaRoleManagementEntitlementManagementRoleDefinition begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [AccessReview.Read.All, AccessReview.ReadWrite.All, Agreement.Read.All, Application.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, AuditLog.Read.All, AuditLogsQuery.Read.All, AuthenticationContext.Read.All, BitlockerKey.Read.All, BitlockerKey.ReadBasic.All, ConsentRequest.Read.All, CrossTenantInformation.ReadBasic.All, DelegatedPermissionGrant.ReadWrite.All, Device.Read.All, Device.ReadWrite.All, DeviceLocalCredential.ReadBasic.All, DeviceManagementApps.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, DeviceManagementServiceConfig.ReadWrite.All, Directory.AccessAsUser.All, Directory.Read.All, Directory.ReadWrite.All, DirectoryRecommendations.Read.All, Domain.Read.All, email, EntitlementManagement.Read.All, EntitlementManagement.ReadWrite.All, ExternalConnection.Read.All, Files.Read.All, Files.ReadWrite, Files.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, GroupMember.ReadWrite.All, Group-OnPremisesSyncBehavior.ReadWrite.All, IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, Insights-UserMetrics.Read.All, LicenseAssignment.Read.All, LifecycleWorkflows.ReadWrite.All, MailboxSettings.Read, MailboxSettings.ReadWrite, NetworkAccess.ReadWrite.All, NetworkAccessPolicy.ReadWrite.All, openid, Organization.Read.All, OrgSettings-Forms.Read.All, Place.Read.All, Policy.Read.All, Policy.Read.ConditionalAccess, Policy.Read.PermissionGrant, Policy.ReadWrite.ApplicationConfiguration, Policy.ReadWrite.Authorization, Policy.ReadWrite.ConditionalAccess, Printer.ReadWrite.All, PrivilegedAccess.Read.AzureAD, PrivilegedAccess.Read.AzureADGroup, PrivilegedAccess.ReadWrite.AzureADGroup, profile, Reports.Read.All, RoleAssignmentSchedule.Read.Directory, RoleEligibilitySchedule.Read.Directory, RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.Read.All, RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory, RoleManagementPolicy.Read.AzureADGroup, RoleManagementPolicy.Read.Directory, RoleManagementPolicy.ReadWrite.AzureADGroup, Sites.FullControl.All, Sites.Read.All, Sites.ReadWrite.All, SynchronizationData-User.Upload, Tasks.Read, Team.ReadBasic.All, ThreatHunting.Read.All, User.DeleteRestore.All, User.Read, User.Read.All, User.ReadBasic.All, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All].
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
GET
Absolute Uri:
https://graph.microsoft.com/beta/roleManagement/entitlementManagement/roleDefinitions?$filter=DisplayName eq %27AccessPackage assignment manager%27
Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26200; en-CH),PowerShell/7.6.2
SdkVersion : graph-powershell-beta/2.38.0
client-request-id : 4067d11f-1c21-4847-9b7e-513b3009d2cf
Accept-Encoding : gzip,deflate
Body:
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
OK
Headers:
Date : Thu, 18 Jun 2026 07:44:50 GMT
Transfer-Encoding : chunked
Connection : keep-alive
Cache-Control : private
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 00697b0d-08b4-4a6c-940d-453aa5791b37
client-request-id : 4067d11f-1c21-4847-9b7e-513b3009d2cf
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Switzerland North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"ZRH2EPF000000EC"}}
Link : https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:microsoft.applicationAuthorization&from=2025-01-01&to=2025-02-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html"
Deprecation : Tue, 21 May 2024 23:59:59 GMT
Sunset : Thu, 21 May 2026 23:59:59 GMT
OData-Version : 4.0
X-Cache : CONFIG_NOCACHE
Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/entitlementManagement/roleDefinitions",
"value": []
}
DEBUG: [CmdletEndProcessing]: - Get-MgBetaRoleManagementEntitlementManagementRoleDefinition end processing.
</details>
### Configuration
_No response_
### Other information
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the documented Get-MgBetaRoleManagementEntitlementManagementRoleDefinition cmdlet and the beta roleDefinitions endpoint shown in the debug output. Compare the DisplayName eq, Id eq, and startswith requests for the named role, then determine whether the behavior belongs to the PowerShell SDK or the Graph service. Done means the exact DisplayName equality filter returns the role definition consistently with the other filters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100