We are trying to provision our dev subscriptions where a certain group has a permanent active contributor PIM role assignment.
We are setting the role settings with Set-AzureADMSPrivilegedRoleSetting
UserSettings: {"permanentAssignment": true}
Get Settings:
...
"UserEligibleSettings": [
{
"RuleIdentifier": "AttributeConditionRule",
"Setting": "{\"condition\":null,\"conditionVersion\":null,\"conditionDescription\":null,\"enableEnforcement\":false}"
}
],
"UserMemberSettings": [
{
"RuleIdentifier": "TicketingRule",
"Setting": "{\"ticketingRequired\":false}"
},
{
"RuleIdentifier": "AcrsRule",
"Setting": "{\"acrsRequired\":false,\"acrs\":null}"
},
{
"RuleIdentifier": "AttributeConditionRule",
"Setting": "{\"condition\":null,\"conditionVersion\":null,\"conditionDescription\":null,\"enableEnforcement\":false}"
},
{
"RuleIdentifier": "ExpirationRule",
"Setting": "{\"permanentAssignment\": true}"
},
{
"RuleIdentifier": "MfaRule",
"Setting": "{\"mfaRequired\":false}"
},
{
"RuleIdentifier": "JustificationRule",
"Setting": "{\"required\":true}"
},
{
"RuleIdentifier": "ApprovalRule",
"Setting": "{}"
}
]
...
Creating the 'Eligible' assignment works with Open-AzureADMSPrivilegedRoleAssignmentRequest
with $schedule
$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule
$schedule.Type = "Once"
$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$schedule.endDateTime = $null
However activating it with Open-AzureADMSPrivilegedRoleAssignmentRequest -AssignmentState 'Active' fails with the message` (same schedule)
##[error]Error occurred while executing OpenAzureADMSPrivilegedRoleAssignmentRequest
Code: RoleAssignmentRequestPolicyValidationFailed
Message: The following policy rules failed: ["ExpirationRule"]
InnerError:
RequestId: fc553c22-454d-4aae-83ed-15aba6dc1d8d
DateTimeStamp: Mon, 07 Feb 2022 13:13:03 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed