WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
Skip to content

Conversation

@JulianSteiman
Copy link
Contributor

Fix the issue in #103

The script Get-AzurePIMDirectoryRoles.ps1 is fetching all roleEligibilityScheduleInstances then using the roleDefinitionId to fetch the policyId using this graph endpoint v1.0/policies/roleManagementPolicyAssignments to then get the rules for the role

The roleDefinitionId for Entra Id Custom Roles received from the "roleEligibilityScheduleInstances" call cannot be used for fetching the roleManagementPolicyAssignments

I've changed the
$rules = Get-PIMDirectoryRoleAssignmentSetting -roleId $_.roleDefinitionId -dontBeautify
to use
$rules = Get-PIMDirectoryRoleAssignmentSetting $_.roleDefinition.templateId -dontBeautify

I've tested the change in my environment, but please verify my PR in a environment with both eligible PIM assignments on BuiltIn role and on a Entra Id custom role

@ztrhgf
Copy link
Contributor

ztrhgf commented Dec 17, 2025

I was ready to publish the same fix now, but glad someone has already fixed it.

I can confirm this is the correct fix for this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants