List Privileged group assignments for a user with prowershell and MS Graph

Question

List Privileged group assignments for a user with prowershell and MS Graph

Vincent Janssens de Bisthoven 0

Hello, I want to get all eligible and all assigned Privileged Access Group assignments for a user account. I am getting the error "Attempted to perform an unauthorized operation" when I use the command "Get-MgRoleManagementDirectoryRoleAssignmentSchedule -Filter "PrincipalID eq {principalid}" or "Get-MgRoleManagementDirectoryRoleEligibilitySchedule -Filter "PrincipalID eq {principalid}". Any help is welcome, Vincent

1 answer

Your answer

Answer 1

Vasil Michev 115.7K MVP

Make sure you have sufficient permissions to call the cmdlet, you will need the RoleManagement.Read.Directory scope consented to. Here's a working example:

Connect-MgGraph -Scopes RoleManagement.Read.Directory

Get-MgRoleManagementDirectoryRoleEligibilitySchedule -Filter "principalId eq '00f475c3-ef4d-41d3-afb1-73d76ab8a9fa'"

Vincent Janssens de Bisthoven 0 Reputation points

2024-01-29T08:51:47.4033333+00:00

Hi Vasil Michel, I want to get all eligible and all assigned Privileged Access Group assignments for a user account not Role assignments. I have the Privileged Role Administrator. In MS graph I have PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup,PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup permissions. Kr, Vincent

Vasil Michev 115.7K MVP

For PAGs, the corresponding cmdlets would be Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentSchedule and Get-MgBetaIdentityGovernancePrivilegedAccessGroupEligibilitySchedule. I was thrown off by your example above where you used the Role assignment cmdlets.

Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentSchedule -Filter "groupId eq '00f475c3-ef4d-41d3-afb1-73d76ab8a9fa'"    
CreatedDateTime   CreatedUsing                         Id                                                                               ModifiedDateTime Status      AccessId AssignmentType GroupId                              MemberType PrincipalId
---------------   ------------                         --                                                                               ---------------- ------      -------- -------------- -------                              ---------- -----------
28/01/24 12:58:55 f17536ca-15da-412a-91d3-d53228f302cc 00f475c3-ef4d-41d3-afb1-73d76ab8a9fa_member_f17536ca-15da-412a-91d3-d53228f302cc                  Provisioned member   assigned       00f475c3-ef4d-41d3-afb1-73d76ab8a9fa direct     e0d7442c-8cd8-4e65-8ede-ec9887816677

Share via

List Privileged group assignments for a user with prowershell and MS Graph

1 answer

Your answer