Graph api call to make AAD role assignment request not working

ravishekharreddy yanamala 1 Reputation point
2021-02-03T15:38:48.09+00:00

Running the below powershell script by fetching access token generated using a NPA and service principal with below permission's to assignment an object to Directory readers AAD role.

Code was working till last week and from Monday getting the UnauthorizedAccessException when the call is made to make the assignment request. Still with access token, other api calls to get roleDefinitions and roleAssignments are working fine.

Please let us know if there are any breaking changes with this api call or what permissions required to make roleAssignmentRequest as this was working till last week.

NPA is Privileged Role Admin and Service principal (used to fetch token) has Api permission : Directory.AccessAsUser.All (Delegated scope)

Code snippet

$body = @'
{
'roleDefinitionId': '$($roleDefinitionId)',
'resourceId': '$($TenantId)',
'subjectId': '$($PrincipalId)',
'assignmentState': '$($AssignmentState)',
'type': 'AdminAdd',
'reason': 'SQLMI Role Assignment to Directory Reade',
'schedule': {
'type': 'Once'
}
}
'@
$roleAssignmentRequestParams = @{
'ContentType' = 'application/json'
'Headers' = @{
'Authorization' = 'Bearer $($GraphAccessToken)'
'accept' = 'application/json'
}
'Body' = $body
'Method' = 'Post'
'URI' = 'https://graph.microsoft.com/beta/privilegedAccess/aadroles/roleAssignmentRequests'
}
Try {
Invoke-RestMethod @roleAssignmentRequestParams -UseBasicParsing
}
Catch {
Write-Error 'Error creating new role assignment request: ($_.Exception.Message)'
}

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Entra | Other
0 comments No comments

1 answer

Sort by: Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    2 deleted comments

    Comments have been turned off. Learn more

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.