Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.9.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.2.1-preview0010] - 2026-10-18

A PIM for Groups activation is no longer written or applied as a standing membership.
`Get-OERInventory` and `Export-OERInventory` leave out a member or owner held by a PIM activation or
time-bound active assignment, counted per group in `Export-OERInventory`'s README; with the PIM
assignments unread, they omit eligible ones and report `InventoryPartial`. `Invoke-OERStructure`
adds no member or owner PIM holds or makes eligible and `-Prune` removes none; it adds and removes
no member or owner of an existing group whose PIM state is unread. Needs
`PrivilegedAssignmentSchedule.Read.AzureADGroup`.

`Get-OERInventory` and `Export-OERInventory` leave out role assignments at the Azure root scope `/`
with a warning; the bundle README lists them as elevated access. `Test-OERStructure` warns on one,
and `Invoke-OERStructure` never creates or prunes there. It updates an access review found by name
only if it reviews the declared package and policy (a non-unique name must be an id), else fails it
(`AccessReviewScopeMismatch`), writing nothing.

`Set-OERAccessPackageAssignmentPolicy` no longer drops custom extension stages and can update an
automatic assignment policy. `Test-OERStructure` refuses an invalid `mailNickname` and a scope with
a dot segment, `%`, `\`, `?`, `#` or stray white space, and warns when a renamed group keeps its
alias. `New-OERGroup` refuses an underivable alias. `-WhatIf` plans a package in a new catalog as
created.

`Invoke-OERStructure` renames administrative units, catalogs and access packages through
`previousDisplayName`, like groups: the object found only under its previous name is renamed; if both
names find different objects, or neither finds one, the entry fails and writes nothing. In the same
run, a group created into a renamed unit and a package in a renamed catalog find the renamed object
by id.

Assignment policies, within their package, and access reviews are renamed the same way, and an
access review that names the new name of a package or policy renamed in the same run reaches it.
`Set-OERAccessPackageAssignmentPolicy` renames a policy given `-DisplayName` alone. A catalog that
`Invoke-OERStructure` fails to read is now `Failed`, with nothing written to it, instead of being
updated.

`groupsRoster.json` rows now carry each group's id, type, visibility and creation time. Inventories
count shared group names tenant-wide, leave out same-named policies of one package (now refused in a
document) and name a shared catalog, review target or role-assignment group by id; the export README
lists each name and count. `Invoke-OERStructure` fails, writing nothing, when a package it would
create exists in another catalog.

Inventories set `principalStatus` `Deleted`/`Unresolved` for a role assignment whose principal
Entra ID does not return (apply never creates it), mark failed lookups as partial and omit one at
an undeclarable scope. Exports flag PIM groups in restricted units. Reviews reach a declared
package via its entry, failing if `-Include` lacks `AccessPackages` (or use the id) or `-WhatIf`
plans it as new.

`Export-OERInventory` writes `lighthouseDelegations.json`: Azure Lighthouse delegations at the
subscriptions it reads, access a managing tenant holds that no role assignment shows, as read-only
findings the README lists. A failed read makes it partial.

`Export-OERInventory` reads only the session tenant's own subscriptions and names the others in its
README; `Invoke-OERStructure` refuses a role assignment or policy in another tenant's subscription.