Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.11.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.3.1] - 2026-10-23

More failed inventory reads are now reported. `Get-OERInventory` names a failed role assignment or
role management policy read as unread through `InventoryPartial` (a `-CommonRoles` role it cannot
read is still skipped with a warning). An empty, `$null` or white space `-Scope`, `-Subscription`
or `-ManagementGroup` is refused at binding by `Get-OERInventory`, and a `-Scope` or
`-ManagementGroup` by `Export-OERInventory`, where an empty `-Scope` meant a tenant-wide walk.
`Export-OERInventory` reports a stopped Azure eligibility, Lighthouse or policy selection read,
warns when `-AllRolePolicies` or `-AllDirectoryRolePolicies` has no section, writes no bundle when
its own sign-in is refused, and names the bundle folder and its `TenantId` by the granted tenant ID
when the session names none. Both commands write members, owners, eligibility and unit members in
one fixed order, and a dynamic group's members as null, so a `-Prune` plan shows no member row for
it.

`Invoke-OERStructure` and `Set-OERGroupPimPolicy` write no guessed value after a failed or empty
read, and `-WhatIf` fails a directory role or group PIM policy needing approval by nobody. In a
thread job `Invoke-OERStructure` needs `-Confirm:$false` or `-WhatIf` (`ConfirmationUnavailable`).
`Set-OERAccessPackageAssignmentPolicy` refuses to write back a read `unknownFutureValue` without
`-RequestorScope`. Validation refuses an unresolvable group template and, before PowerShell 7.5, a
timestamp with seconds.

The module's Microsoft Graph and Azure Resource Manager transports now refuse a paged read that
cannot finish instead of returning a shorter list: a later page that is empty or has no `value`, a
next link already requested and a walk past 100000 pages, with `GraphPagingIncomplete` or
`ArmPagingIncomplete`, and an Azure body that is not JSON, with `ArmResponseUnreadable`. Under
`-ErrorAction SilentlyContinue` such a read returns nothing.

AzAuth 2.11.0 or later is required. Near expiry an interactive session first tries a renewal from
AzAuth's stored credential, for fewer prompts (same account and tenant; never when both tokens
renew together). `pwsh -NonInteractive` refuses interactive sign-in
(`InteractiveSignInUnavailable`). Profile files escape every single quote. `Invoke-OERStructure`
reports an unresolvable scope's own error id; `Get-OERInventory` names no `tenantId` after its
refused sign-in.

A `-TenantId` no longer lets a command continue under another identity's session:
`Invoke-OERStructure` and the access package and review stage builders refuse a call when another
application or account replaced the tenant's session, and a cmdlet that a replaced command calls is
refused before it requests a token. A renewal answered by another account is refused with
`SignInSuperseded` and its token is not used: the session stays the account it was until
`Connect-OER`.

Messages now say what the module does: `PolicyOpenFailed` gives a command that runs as typed,
`Export-OERInventory`'s `InventoryPartial` is shorter, `SignInSuperseded` no longer calls every account change
a renewal, and a warning for a review cadence the module cannot write names the cadence exported.