How to activate Privileged Access Groups using Powershell?

Sanjeev 11 Reputation points
2022-03-25T18:21:33.567+00:00

I am trying to activate my privileged access groups using powershell however so far unable to do so. All the examples either in MS Docs site or google search only have examples regarding instruction to activate roles using powershell for PIM.

Has anyone been successful or have an idea how to get privileged access groups activated using powershell?

Here is what i tried:

#variables  
$upn = ""  
$tenantId = ""  
$reason = "Test"  
$groupId = "" #privileged access groups Id retrieved from Azure Portal > Groups > <group which has roles>  

#MFA setup  
if(!(Get-Module | Where-Object {$_.Name -eq 'PowerShellGet' -and $_.Version -ge '2.2.4.1'})) { Install-Module PowerShellGet -Force }  
if(!(Get-Package msal.ps)) { Install-Package msal.ps }  

# Get token for MS Graph by prompting for MFA  
$MsResponse = Get-MSALToken -Scopes @("https://graph.microsoft.com/.default") -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -RedirectUri "urn:ietf:wg:oauth:2.0:oob" -Authority "https://login.microsoftonline.com/common" -Interactive -ExtraQueryParameters @{claims='{"access_token" : {"amr": { "values": ["mfa"] }}}'}  

# Get token for AAD Graph  
$AadResponse = Get-MSALToken -Scopes @("https://graph.windows.net/.default") -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -RedirectUri "urn:ietf:wg:oauth:2.0:oob" -Authority "https://login.microsoftonline.com/common"  

Connect-AzureAD -AadAccessToken $AadResponse.AccessToken -MsAccessToken $MsResponse.AccessToken -AccountId: $upn -tenantId: $tenantId  

$roleDefinitionCollection = Get-AzureADMSPrivilegedRoleAssignment -ProviderId "aadRoles" -ResourceId $resource.Id -Filter "subjectId eq '$grouipId'"  

#set schedule  
$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule  
$schedule.Type = "Once"  
$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")  
$schedule.endDateTime = (Get-Date).AddHours($activateTime).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")  

$subject = Get-AzureADUser -Filter "userPrincipalName eq '$upn'"  

foreach ($roleDefinition in $roleDefinitionCollection) {  
    Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId AadRoles -Schedule $schedule -ResourceId $resource.Id -RoleDefinitionId $roleDefinition.RoleDefinitionId -SubjectId $subject.ObjectId -AssignmentState "Active" -Type "UserAdd" -Reason $reason  
}

This returns error message:

Open-AzureADMSPrivilegedRoleAssignmentRequest : Error occurred while executing OpenAzureADMSPrivilegedRoleAssignmentRequest
Code: RoleAssignmentDoesNotExist
Message: The Role assignment does not exist.
InnerError:
RequestId: b6e750c4-acf4-4032-84ea-29d74fbc53ac
DateTimeStamp: Fri, 25 Mar 2022 19:00:10 GMT
HttpStatusCode: NotFound
HttpStatusDescription: Not Found
HttpResponseStatus: Completed
At line:2 char:5

  • Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId AadRole ...
  • ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  • CategoryInfo : NotSpecified: (:) [Open-AzureADMSP...signmentRequest], ApiException
  • FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.OpenAzureADMSPrivilegedRoleAssignmentRequest

These were some of the sites that i referred: (all only have example to activate the role)
http://www.anujchaudhary.com/2020/02/connect-to-azure-ad-powershell-with-mfa.html
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/powershell-for-azure-ad-roles#activate-a-role-assignment
https://www.youtube.com/watch?v=OVfwO8_eDjs

Microsoft Entra

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sanjeev 11 Reputation points
    2022-04-07T21:32:03.6+00:00
    2 people found this answer helpful.
  2. Marilee Turscak-MSFT 33,706 Reputation points Microsoft Employee
    2022-04-15T18:09:57.15+00:00

    Thanks @Sanjeev ,

    To add to your answer, I did also receive a response from the PG around this.

    We don't have an official PowerShell for this right now, but the PG is working on designing a set of graph API for privileged access group and releasing it before we generate a PS commandlet on top of the API.

    If it is urgent and a one-time setup, there is an unofficial PowerShell module to achieve what you are looking for. It is basically using the PowerShell for PIM for Azure AD roles (https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/powershell-for-azure-ad-roles) but replacing the "aadRoles" providerID parameter with "aadgroups" and replacing the resourceID with the ID of the group. (It looks like that was the solution that was provided to you in the Stack Overflow post.)

    Thanks again for following up on this. If you would be so kind as to accept one of our answers as the answer, that would help others in the community more easily find a solution.

    Best,

    Marilee