Powershell Activate PIM assignment, permanently

Viewed 373

We are trying to provision our dev subscriptions where a certain group has a permanent active contributor PIM role assignment.

We are setting the role settings with Set-AzureADMSPrivilegedRoleSetting
UserSettings: {"permanentAssignment": true}

Get Settings:

...
"UserEligibleSettings":  [
     {
         "RuleIdentifier":  "AttributeConditionRule",
         "Setting":  "{\"condition\":null,\"conditionVersion\":null,\"conditionDescription\":null,\"enableEnforcement\":false}"
     }
 ],
"UserMemberSettings":  [
   {
       "RuleIdentifier":  "TicketingRule",
       "Setting":  "{\"ticketingRequired\":false}"
   },
   {
       "RuleIdentifier":  "AcrsRule",
       "Setting":  "{\"acrsRequired\":false,\"acrs\":null}"
   },
   {
       "RuleIdentifier":  "AttributeConditionRule",
       "Setting":  "{\"condition\":null,\"conditionVersion\":null,\"conditionDescription\":null,\"enableEnforcement\":false}"
   },
   {
       "RuleIdentifier":  "ExpirationRule",
       "Setting":  "{\"permanentAssignment\": true}"
   },
   {
       "RuleIdentifier":  "MfaRule",
       "Setting":  "{\"mfaRequired\":false}"
   },
   {
       "RuleIdentifier":  "JustificationRule",
       "Setting":  "{\"required\":true}"
   },
   {
       "RuleIdentifier":  "ApprovalRule",
       "Setting":  "{}"
   }
]
...

Creating the 'Eligible' assignment works with Open-AzureADMSPrivilegedRoleAssignmentRequest

with $schedule

$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule
$schedule.Type = "Once"
$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$schedule.endDateTime = $null

However activating it with Open-AzureADMSPrivilegedRoleAssignmentRequest -AssignmentState 'Active' fails with the message` (same schedule)

##[error]Error occurred while executing OpenAzureADMSPrivilegedRoleAssignmentRequest 
Code: RoleAssignmentRequestPolicyValidationFailed
Message: The following policy rules failed: ["ExpirationRule"]
InnerError:
  RequestId: fc553c22-454d-4aae-83ed-15aba6dc1d8d
  DateTimeStamp: Mon, 07 Feb 2022 13:13:03 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed

0 Answers
Related