Unable to add emailIDs in AzureAD roles notifications using Set-AzureADMSPrivilegedRoleSetting

Question

Hi Team,

I am trying to add below notifications under Azure active directory | Identity governance| Azure AD Roles | roles | Intune administrator| Settings using

$id = (Get-AzureADMSPrivilegedRoleSetting -ProviderId 'aadRoles' -Filter "ResourceId eq 'XXXX' and RoleDefinitionId eq 'XXXX'").id
$settings = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedRuleSetting
$settings.RuleIdentifier = ?
$settings.Setting = ?
Set-AzureADMSPrivilegedRoleSetting -ProviderId 'XXX' -Id $id -ResourceId XXXX' -RoleDefinitionId 'XXXX' -UserMemberSettings $settings

I need some help to add values to $settings.RuleIdentifier and $settings.Setting for enabling notifications, Kindly help? here we have to use only power shell for automation

Answer 1

Hello @Krupa Gundraju (Larsen & Toubro Infotech Limit) ,

Welcome to the MS Q&A Forum.

If I understand your question correctly, you are looking for the UserMemberSettings to set the notifications parameters.

Below are the optional query parameters for Set-AzureADMSPrivilegedRoleSetting cmdlet for userMemberSettings. As we could see, It seems you can't configure notifications by using this specific cmdlet.

            "userMemberSettings": [  
                {  
                    "ruleIdentifier": "ExpirationRule",  
                    "setting": "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":480}"  
                },  
                {  
                    "ruleIdentifier": "MfaRule",  
                    "setting": "{\"mfaRequired\":false}"  
                },  
                {  
                    "ruleIdentifier": "JustificationRule",  
                    "setting": "{\"required\":true}"  
                },  
                {  
                    "ruleIdentifier": "ApprovalRule",  
                }  
            ]  

Reference: List governanceRoleSettings

As a workaround, you could manage role settings through Microsoft Graph and set these parameters in the request body.

Hope above answers your questions and concerns.

Sincerely,
Olga Os