Roles and administrators (PIM) - AzureAD Resources roles

K Roja 51 Reputation points
2022-10-18T14:02:35.793+00:00

Hello Team,

We are trying to create AzureAD Resources roles in active directory using API but we are getting error. We are unable to create azuread resources roles. PFA the code which we are trying.

And how to get roleassignment scheduleID ??

251637-resourcerolepim.txt

Microsoft Entra
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,660 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Olga Os - MSFT 5,836 Reputation points Microsoft Employee
    2022-10-19T20:03:47.093+00:00

    Sometimes something very obvious lies on the surface and you don't catch it with your eyes. That's story of my life.

    Honestly, I spent some time figuring out why I am getting the same failure on that request, tested in Graph API and CLI using the similar commands. Started from the beginning again, and on 3 or probably 4 time rereading the same article what I shared above, 'Eureka' happened :)

    I did my test by using "Try it":

    Parameters which I passed in my request:

    PUT https://management.azure.com/subscriptions/XXXXXXXXX/providers/Microsoft.Authorization/roleAssignmentScheduleRequests/00000000-0000-0000-0000-000000000000?api-version=2020-10-01

    Body:

    {
    "Properties": {
    "RoleDefinitionId": "/subscriptions/XXXXXXXXX/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
    "PrincipalId": "XXXXXXXXX",
    "RequestType": "AdminAssign",
    "justification": "I know this user",
    "ScheduleInfo": {
    "StartDateTime": "2022-11-09T21:31:27.91Z",
    "Expiration": {
    "Type": "AfterDuration", // Values: AfterDuration, AfterDateTime, NoExpiration
    "EndDateTime": null,
    "Duration": "P30D" // Use ISO 8601 format
    }
    }
    }
    }

    252144-image.png

    My own mistake was what I was using GUID in the "regular" GUID format, like '0f51b19f-32b2-4475-b30a-81dd88a4cc42', and this request expects GUID as only numeric parameter, like '00000000-0000-0000-0000-000000000000'. I tried to find ready to use only GUID numeric generator, checked VS guid generator, PowerShell. So far, couldn't find and just manually edited characters => numeric values ;(

    Sincerely,
    Olga Os