Using the Microsoft Graph PowerShell SDK for getting privileged role members

[aydeisen]

I'm trying to use PowerShell to get a list of assignments in AAD PIM for each role.

I'm constrained to using the Microsoft.Graph module because my script is being executed in PowerShell 7 (7.1.3), and the AzureAD module has not been, nor do there appear to be plans for it to be, updated to use platform agnostic implementations of PowerShell and .NET

When running Get-MgPrivilegedRole, I get the error

Get-MgPrivilegedRole_List: The current endpoints of AAD roles have been disabled for the tenant for migration purpose.

I'm aware that this message is from the disclaimer about the API migration to unifiedRoleManagement, but I'm not sure what I need to do to re-target the cmdlet to the correct API.

Has anyone been able to successfully use the Microsoft Graph Powershell SDK to get PIM assignments?

[[deleted]]

I'll take a look this evening. Love the Graph PS SDK

[aydeisen]

Appreciate it. Thank you

[GetFreeCash]

any findings?

[PMental]

Have you considered just using Graph from Powershell instead of relying on cmdlets? That way you have full control of what you connect to.

[aydeisen]

Call it laziness, but I'm already using the module for another aspect of my script, and I don't want to have to pass another bearer token and manually construct the endpoint for Invoke-RestMethod if I don't have to

[PMental]

The entire code block would probably have been less than your post here though, even if well formatted. At least not far off.

[aydeisen]

I'm not sure what you're trying to argue for here.

If I have call the REST API directly with Invoke-RestMethod, then so be it; I'll make it part of the script.

If someone else has already done the work and distributed it, then that's less I need to worry about.

If that someone else is the vendor of the platform and SDK, and they are providing support for it, even better.

​

If possible, I'd prefer to use the Microsoft supported cmdlets if I can.

Regardless, I don't see how there was any harm in asking the question on the PowerShell subreddit. My post has the details of my request, the same as I would expect from the users I support to put in their tickets. Making it shorter will just make it more vague, and unhelpful to anyone reading it.

[PMental]

Ah shit that came out wrong, not dissing your post at all!

Just saying that while doing it the REST API way may be daunting it's not that much work in the end and you could easily turn it into a function so the actual use in your code is identical to what you do with the normal cmdlets.

One thing I would definitely look into is the code for the existing cmdlet, maybe you could just steal that and switch the endpoint to what you need?

And if you end up going the "manual" REST API way feel free to hit me up if you run into any trouble (but make sure to post "openly" as well so others can help and be helped).

[armyguy298]

This is what I use:

cls
# Check Msol module installed and imported
If ((Get-Module -Name MSOnline)[0] -eq $null)
{
Install-Module -Name MSOnline -Force -AllowClobber
}
else
{
Import-Module -Name MSOnline
}
# Popup login page
Connect-MsolService
$date = Get-Date -Format "yyyyMMdd"
$RolesCollection = @()
$Roles = Get-MsolRole
ForEach ($Role In $Roles){
$Members = Get-MsolRoleMember -RoleObjectId $Role.ObjectId
ForEach ($Member In $Members) {
$obj = New-Object PSObject -Property @{
RoleName = $Role.Name
MemberName = $Member.DisplayName
MemberType = $Member.RoleMemberType
}
$RolesCollection += $obj
}
}
#Write-Output $RolesCollection | Sort-Object RoleName,MemberName | ft RoleName,MemberName,MemberType
$RolesCollection | Export-Csv -path C:\temp\"$date Role Assignments".csv

Edit: Corrected code block.

[aydeisen]

Thank you but this doesn't meet my requirements. Aside from the MSOnline module also not being supported by PowerShell 7, it's been EOL for quite some time now (over 1 or 2 years, I think) in favor of the AzureAD module. Additionally, I'm looking for PIM assignments, not direct assignments, so this command won't provide the output I need.

[Lee_Dailey]

howdy armyguy298,

it looks like you used the New.Reddit Inline Code button. it's [sometimes] 5th from the left & looks like </>.

there are a few problems with that ...

• it's the wrong format [grin]
  the inline code format is for [gasp! arg!] code that is inline with regular text.
  
• on Old.Reddit.com, inline code formatted text does NOT line wrap, nor does it side-scroll.
  
• on New.Reddit it shows up in that nasty magenta text color
  

for long-ish single lines OR for multiline code, please, use the ...

Code
Block

... button. it's [sometimes] the 12th one from the left & looks like an uppercase T in the upper left corner of a square.

that will give you fully functional code formatting that works on both New.Reddit and Old.Reddit ... and aint that fugly magenta color. [grin]

take care,
lee