Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.9.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.1.2-preview0002] - 2026-10-04

`Invoke-OERStructure` groups, matches and prunes `roleAssignments` on the scope it resolves,
not on the text the document wrote. `sub:` and `subscription:` with an id, `/subscriptions/` with
that id, the subscription's name, and `mg:` with a management group's name or display name and its
path now name one scope, compared without regard to letter case. Earlier versions treated each
spelling as its own scope, so under `-Prune` two entries for one scope could remove each other's
assignments on every run. A role given by its GUID now matches the live assignment at a resource
group, where `-Prune` used to remove and re-create it on every run; it is matched on the GUID at a
management group too. A scope that cannot be resolved withholds the prune of the whole
`roleAssignments` section, and an entry that resolves to the same scope, principal and role as an
earlier one is reported `Failed` and not written. A failed read of the assignments at a scope now
reports the entry `Failed` with the read error, and no prune runs for that scope; earlier versions
took the failed read for an empty list and planned to create assignments that exist. A
`roleAssignments` or `roleManagementPolicies` scope written with a trailing `/` (other than `/`
itself) or with `//` is now refused before anything is written, never read as another spelling of a
scope.

`Test-OERStructure` now reports, and `Invoke-OERStructure` refuses, a document that declares the
same group, administrative unit, catalog, access package within one catalog, access review, role
assignment, Azure role policy or directory role policy twice, compared without regard to letter case.
`Get-OERInventory` and `Export-OERInventory` never write such a duplicate: objects that share a
name are left out and named in `InventoryPartial`, and role assignment principals that share a
name are written by object id.