Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.9.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.1.3-preview0006] - 2026-10-07

Group reads now include service principals, which Microsoft Graph's v1.0 member and owner lists
leave out: `Get-OERGroup -IncludeMembers -IncludeOwners`, `Get-OERGroupMember`, the inventory export
and `Invoke-OERStructure` missed them. Each read now also asks for them, and a read that cannot be
completed leaves the collection unread rather than half-read. An apply document that does not list a
group's service principals, such as one exported by an earlier version, reports them `Extra`, and
`-Prune` leaves them in place, as earlier versions did.

`Invoke-OERStructure` without `-TenantId`, and the builders that look up a name
(`New-OERAccessPackageApprovalStage`, `New-OERAccessPackageRequestorScope`,
`New-OERAccessReviewStage`), now refuse with `SignInSuperseded` and send nothing when another
command in their pipeline signs in to another tenant or identity after they began. In a script
block they begin only when it runs: name `-TenantId` there. When a command's sign-in is refused, the
cmdlets it calls are now refused at their own sign-in too (`SignInRefused`), before any token
request or prompt.

A tenant named by domain is now looked up at the cloud's sign-in authority before any token
request, and each token is checked against it: one from another tenant is refused with
`TenantMismatch`, a domain that names no tenant, or `common`, with the new `TenantResolutionFailed`,
and the warning after such a sign-in is gone. After a sign-in fails or is refused, a command naming
no tenant sends nothing (`SignInRefused`) until a sign-in naming its tenant, `Connect-OER` or
`Disconnect-OER` succeeds. An empty `-TenantId` is refused, by `Connect-OER` with the new
`InvalidTenantId`, and an Azure token no longer outlives a renewal from another tenant.

`Set-OERGroupPimPolicy` puts back the accepted half of the MFA and authentication context pair when
Graph rejects the other. Neither it nor `Set-OERDirectoryRoleManagementPolicy` warns between its first
rule update and its last, so `-WarningAction Stop` no longer stops half-way. These two and
`Set-OERRoleManagementPolicy` refuse `-RequireApproval $false` beside an approver parameter
(`MutuallyExclusiveParameter`), and the last refuses an empty approver list (`ApproverRequired`). In
`Invoke-OERStructure`, an empty Azure approver side now matches an empty live one.

Eleven cmdlets that send a PIM schedule request now treat an accepted request answered with a status
starting `Failed` as an error, after the request object (`EligibilityRequestFailed`, or the new
`AssignmentRequestFailed`), so `Invoke-OERStructure` reports the row Failed.
`Set-OERAccessPackageAssignmentPolicy` refuses a connected-organization scope that names none
(`InvalidPolicyInput`). `New-OERActiveRoleAssignment` opens a role policy for a permanent assignment
only once confirmed; it and `New-OEREligibleRoleAssignment` roll it back if the assignment fails.