Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.9.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.1.4-preview0013] - 2026-10-10

A permanent group eligibility grant refused after `Add-OERGroupEligibility` opened the group's PIM
policy now reports `PolicyOpenedButGrantFailed` first, naming the open policy, why the grant failed
and how to close it (`Set-OERGroupPimPolicy -AllowPermanentEligibility:$false`; the old advice
left it open), even under `-ErrorAction Stop` and in `Invoke-OERStructure` results.
`Invoke-OERStructure`'s wait on a group it created now says, in `GroupNotOnboarded` and a later
attempt's error, whether the policy was opened and, if so, how to close it. The Azure role
assignment cmdlets no longer report a rollback that finds nothing to change as failed but ask for a
confirming read. No ErrorId changed.

`Disconnect-OER` now ends only the module's own Graph SDK session and warns when it leaves another.
An ARM request without a token is refused (`ArmTokenAcquisitionFailed`), not sent.
`New-`/`Set-OERConfiguration` refuse a white-space `-TenantId`. `SignInSuperseded` names its actual
cause; `SignInRefused` after a failed sign-in no longer says the session may be the previous
tenant's.

Every device code sign-in, Microsoft Graph and ARM alike, now prints a new code, so a later one in
the same session no longer reuses AzAuth's process-wide credential, which could hang, showing no
code, and needs no `-Force`. The help and README say how a long run renews its token per sign-in
type and what it asks of you.

`Invoke-OERStructure -WhatIf` now plans an Azure role policy entry whose approvers name nobody as
the run does: `Failed` with `ApproverRequired`, and changes nothing. `Test-OERStructure` refuses a
`tenantId` that is not a string, as the schema does, or that ends in a line break. The
`NotDirectAssignment` example now parses for a role name with a curly apostrophe.

`SemiAnnually` (every six months) is a new access review cadence for
`New-`/`Set-OERAccessReviewDefinition` and a structure document's `recurrence`. A live six-month
review now exports as `SemiAnnually` without a warning and applies as `Unchanged`; an older
export's `Monthly` approximation is skipped on apply, with a warning, leaving the review
semi-annual.

`Get-OERManagementGroup` now shows the parent of every listed group (the tenant root group has
none); an unreadable parent is reported as `ManagementGroupParentReadFailed`, not left empty.
`-Expand` or `-Recurse` without `-Name` now fails at parameter binding, or prompts for `-Name` where
the host can. An empty `-Name` is refused instead of listing every group.

`Get-OERGroup` now shows `OnPremisesSyncEnabled`, in its table too. `groupsRoster.json` marks every
group `onPremisesSynced`, and `Export-OERInventory -IncludeSyncedGroups` keeps synchronized security
groups in full detail in `inventory.json`, marked `onPremisesSynced: true`. `Invoke-OERStructure`
writes nothing to a synchronized group: each change is `Skipped`, one warning per group, and
`-Prune` leaves it untouched.

`Export-OERInventory` now reads members, owners and PIM policies only for the groups it keeps in
full -- role-assignable, with PIM eligibility, found to use PIM for Groups, or synchronized under
`-IncludeSyncedGroups` -- or cannot classify, and shows progress; `groupsRoster.json` gives the
others `memberCount` null. The new `-GroupFilter` narrows the exported groups, never widens them.

`Export-OERInventory` now keeps an Azure role's PIM policy at a scope only if the role is assigned
or eligible exactly there or the policy changed, at one more role assignment read per scope; apply
leaves the rest untouched. A policy it cannot judge is kept, its scope named in `IncompleteReads`
and `InventoryPartial`. `-AllRolePolicies` keeps all, as before.

The module's page on the PowerShell Gallery now shows its icon.