A cloud-based identity and access management service for securing user authentication and resource access
Graph api call to make AAD role assignment request not working
Running the below powershell script by fetching access token generated using a NPA and service principal with below permission's to assignment an object to Directory readers AAD role.
Code was working till last week and from Monday getting the UnauthorizedAccessException when the call is made to make the assignment request. Still with access token, other api calls to get roleDefinitions and roleAssignments are working fine.
Please let us know if there are any breaking changes with this api call or what permissions required to make roleAssignmentRequest as this was working till last week.
NPA is Privileged Role Admin and Service principal (used to fetch token) has Api permission : Directory.AccessAsUser.All (Delegated scope)
Code snippet
$body = @'
{
'roleDefinitionId': '$($roleDefinitionId)',
'resourceId': '$($TenantId)',
'subjectId': '$($PrincipalId)',
'assignmentState': '$($AssignmentState)',
'type': 'AdminAdd',
'reason': 'SQLMI Role Assignment to Directory Reade',
'schedule': {
'type': 'Once'
}
}
'@
$roleAssignmentRequestParams = @{
'ContentType' = 'application/json'
'Headers' = @{
'Authorization' = 'Bearer $($GraphAccessToken)'
'accept' = 'application/json'
}
'Body' = $body
'Method' = 'Post'
'URI' = 'https://graph.microsoft.com/beta/privilegedAccess/aadroles/roleAssignmentRequests'
}
Try {
Invoke-RestMethod @roleAssignmentRequestParams -UseBasicParsing
}
Catch {
Write-Error 'Error creating new role assignment request: ($_.Exception.Message)'
}
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Entra | Other
Additional Microsoft Entra services and features related to identity, access, and network security
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
2 deleted comments
Comments have been turned off. Learn more