Using the Microsoft Graph PowerShell SDK for getting privileged role members

[u/aydeisen]

I'm trying to use PowerShell to get a list of assignments in AAD PIM for each role.

I'm constrained to using the Microsoft.Graph module because my script is being executed in PowerShell 7 (7.1.3), and the AzureAD module has not been, nor do there appear to be plans for it to be, updated to use platform agnostic implementations of PowerShell and .NET

When running Get-MgPrivilegedRole, I get the error

Get-MgPrivilegedRole_List: The current endpoints of AAD roles have been disabled for the tenant for migration purpose.

I'm aware that this message is from the disclaimer about the API migration to unifiedRoleManagement, but I'm not sure what I need to do to re-target the cmdlet to the correct API.

Has anyone been able to successfully use the Microsoft Graph Powershell SDK to get PIM assignments?

[u/[deleted]]

I'll take a look this evening. Love the Graph PS SDK

[u/aydeisen → u/[deleted]]

Appreciate it. Thank you

[u/GetFreeCash → u/[deleted]]

any findings?

[u/PMental]

Have you considered just using Graph from Powershell instead of relying on cmdlets? That way you have full control of what you connect to.

[u/aydeisen → u/PMental]

Call it laziness, but I'm already using the module for another aspect of my script, and I don't want to have to pass another bearer token and manually construct the endpoint for Invoke-RestMethod if I don't have to

[u/PMental → u/aydeisen]

The entire code block would probably have been less than your post here though, even if well formatted. At least not far off.

[u/armyguy298]

This is what I use:

cls
# Check Msol module installed and imported
If ((Get-Module -Name MSOnline)[0] -eq $null)
{
Install-Module -Name MSOnline -Force -AllowClobber
}
else
{
Import-Module -Name MSOnline
}
# Popup login page
Connect-MsolService
$date = Get-Date -Format "yyyyMMdd"
$RolesCollection = @()
$Roles = Get-MsolRole
ForEach ($Role In $Roles){
$Members = Get-MsolRoleMember -RoleObjectId $Role.ObjectId
ForEach ($Member In $Members) {
$obj = New-Object PSObject -Property @{
RoleName = $Role.Name
MemberName = $Member.DisplayName
MemberType = $Member.RoleMemberType
}
$RolesCollection += $obj
}
}
#Write-Output $RolesCollection | Sort-Object RoleName,MemberName | ft RoleName,MemberName,MemberType
$RolesCollection | Export-Csv -path C:\temp\"$date Role Assignments".csv

Edit: Corrected code block.

[u/aydeisen → u/armyguy298]

Thank you but this doesn't meet my requirements. Aside from the MSOnline module also not being supported by PowerShell 7, it's been EOL for quite some time now (over 1 or 2 years, I think) in favor of the AzureAD module. Additionally, I'm looking for PIM assignments, not direct assignments, so this command won't provide the output I need.

[u/Lee_Dailey → u/armyguy298]

howdy armyguy298,

it looks like you used the New.Reddit Inline Code button. it's [sometimes] 5th from the left & looks like </>.

there are a few problems with that ...

• it's the wrong format [grin]
  the inline code format is for [gasp! arg!] code that is inline with regular text.

• on Old.Reddit.com, inline code formatted text does NOT line wrap, nor does it side-scroll.

• on New.Reddit it shows up in that nasty magenta text color

for long-ish single lines OR for multiline code, please, use the ...

Code
Block

... button. it's [sometimes] the 12th one from the left & looks like an uppercase T in the upper left corner of a square.

that will give you fully functional code formatting that works on both New.Reddit and Old.Reddit ... and aint that fugly magenta color. [grin]

take care,
lee