Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.11.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.3.2-preview0007] - 2026-11-05

Omnicit.EntraRBAC now requires PowerShell 7.6 or later. PowerShell 7.4 and 7.5 reach end of support
on 10 November 2026, and 7.6 is the current long-term support release; a host on 7.4 or 7.5 can
keep using 1.3.1. Windows, Linux and macOS are supported as before, and no command changes. A
tenant named by domain is looked up before any token is requested, and that lookup now also ends
after 30 seconds when the authority sends its response headers and then stalls, failing with
`TenantResolutionFailed` instead of waiting until it is interrupted.

A read that fails now writes an error record and leaves `$null`, not an empty value; the object is
still returned: `RoleAssignments` (`Get-OERResource`, `Get-OERResourceGroup`), `Stages` and
`Decisions` (`Get-OERAccessReviewInstance`), `RoleName` (`Get-OERDirectoryRoleManagementPolicy`).
`Get-OERRoleManagementPolicy` and `Set-OERRoleManagementPolicy` publish a failed lookup as itself and
an ambiguous role as `AmbiguousName`. A role `-CommonRoles` cannot read is an error, not a warning,
and `Get-OERInventory` reports that section unread.

`Invoke-OERStructure -Prune` keeps a group's last standing owner when the other owners hold, or
are eligible for, ownership through PIM for Groups. It writes the validator's warnings before
signing in, reports rows a handler wrote before failing, and plans an invalid derived mail alias
as Failed. A reference refused through a rename, an `-Include` or a failed access package entry
writes an error record, so `$?` is false and `-ErrorAction Stop` ends the run.
`New-OERAccessPackage -Catalog` refuses a package of another catalog, and
`Set-OERAccessPackageAssignmentPolicy` a policy read lacking a setting.

Microsoft Graph and Azure Resource Manager now act as one account. Signing in as another account,
`Connect-OER -Force` included, drops the previous account's Azure token, and an Azure token issued to
another account than the Microsoft Graph token is never cached: the first sign-in and
`Connect-OER -IncludeARM` now refuse it with `ArmAccountMismatch`, as a renewal already did with
`SignInSuperseded`.

A one-time access review now lasts the days it declares; Microsoft Graph ran it for 30 days.
`Set-OERAccessReviewDefinition -DurationInDays` moves a one-time review's end, never to today or
earlier. An `accessReviews` entry can declare `group` (a name or an id) to review all members of a
group: the export writes it, `Invoke-OERStructure` applies it and refuses a review of another
group, `New-OERAccessReviewDefinition -Group` creates one. The export skips a review whose
reviewers it cannot write back.