Omnicit.EntraRBAC

Author(s)

• Omnicit AB / Philip Haglund

Tags

EntraID Azure RBAC PIM Identity Governance Windows Linux MacOS

Functions

Add-OERAccessPackageResourceRole Add-OERAdministrativeUnitMember Add-OERAdministrativeUnitScopedRole Add-OERCatalogResource Add-OERGroupEligibility Add-OERGroupMember Connect-OER Disable-OEREligibleRoleAssignment Disconnect-OER Enable-OEREligibleRoleAssignment Export-OERInventory Get-OERAccessPackage Get-OERAccessPackageAssignment Get-OERAccessPackageAssignmentPolicy Get-OERAccessPackageResourceRole Get-OERAccessReviewDefinition Get-OERAccessReviewInstance Get-OERAccessReviewInstanceDecision Get-OERActiveDirectoryRoleAssignment Get-OERActiveRoleAssignment Get-OERAdministrativeUnit Get-OERAdministrativeUnitScopedRole Get-OERAuthenticationContext Get-OERCatalog Get-OERCatalogResource Get-OERConfiguration Get-OERDirectoryRoleManagementPolicy Get-OEREligibleDirectoryRoleAssignment Get-OEREligibleRoleAssignment Get-OERGroup Get-OERGroupEligibility Get-OERGroupMember Get-OERGroupPimPolicy Get-OERInventory Get-OERManagementGroup Get-OERRequiredScope Get-OERResource Get-OERResourceGroup Get-OERRoleAssignment Get-OERRoleDefinition Get-OERRoleManagementPolicy Get-OERSubscription Invoke-OERAccessReviewInstanceDecision Invoke-OERStructure New-OERAccessPackage New-OERAccessPackageApprovalStage New-OERAccessPackageAssignment New-OERAccessPackageAssignmentPolicy New-OERAccessPackageRequestorScope New-OERAccessPackageRequestorSettings New-OERAccessReviewDefinition New-OERAccessReviewStage New-OERActiveDirectoryRoleAssignment New-OERActiveRoleAssignment New-OERAdministrativeUnit New-OERCatalog New-OERConfiguration New-OEREligibleDirectoryRoleAssignment New-OEREligibleRoleAssignment New-OERGroup New-OERPolicyNotificationRule New-OERResourceGroup New-OERRoleAssignment Remove-OERAccessPackage Remove-OERAccessPackageAssignment Remove-OERAccessPackageAssignmentPolicy Remove-OERAccessPackageResourceRole Remove-OERAccessReviewDefinition Remove-OERActiveDirectoryRoleAssignment Remove-OERActiveRoleAssignment Remove-OERAdministrativeUnit Remove-OERAdministrativeUnitMember Remove-OERAdministrativeUnitScopedRole Remove-OERCatalog Remove-OERCatalogResource Remove-OERConfiguration Remove-OEREligibleDirectoryRoleAssignment Remove-OEREligibleRoleAssignment Remove-OERGroup Remove-OERGroupEligibility Remove-OERGroupMember Remove-OERResourceGroup Remove-OERRoleAssignment Send-OERAccessReviewReminder Set-OERAccessPackage Set-OERAccessPackageAssignmentPolicy Set-OERAccessReviewDefinition Set-OERAdministrativeUnit Set-OERCatalog Set-OERConfiguration Set-OERDirectoryRoleManagementPolicy Set-OERGroup Set-OERGroupPimPolicy Set-OERResourceGroup Set-OERRoleAssignment Set-OERRoleManagementPolicy Stop-OERAccessReviewInstance Test-OERStructure

PSEditions

Core

Dependencies

• • AzAuth (>= 2.11.0)
  • Microsoft.Graph.Authentication (>= 2.36.0)

Release Notes

## [1.4.1-preview0005] - 2026-11-07

The seven cmdlets that create, remove, activate or deactivate Azure role assignments report a
failed role lookup as that failure and an ambiguous name as `AmbiguousName`; `RoleDefinitionNotFound`
now means only that no role has that name at the scope. In those and the Azure role management policy
cmdlets, an empty or JSON null Azure answer is no longer read as "no such role" or "no such policy"
(`PolicyNotFound`) but as a failed read (`ArmPagingIncomplete`):
`Get-OERRoleManagementPolicy -AllRolesAtScope` reports `RoleEnumerationFailed` instead of a parameter
binding error, and `Get-OERInventory -CommonRoles` names the section unread instead of skipping each role.

`Get-OERInventory` and `Export-OERInventory` write a group, service principal or application whose
display name looks like an object id by its id wherever the document references it, and leave a
group's own `groups` entry out, named as unread, since applying such a name reads it as an object id.
An access review whose namesake the export skips is now left out and counted as a shared name.

An assignment policy update carries every setting the live policy has, an empty list or `false`
included. `Set-OERResourceGroup` refuses a read without a location (`ResourceGroupValueUnknown`),
`Get-OERRoleDefinition -Role` reports an empty Azure answer as `ArmPagingIncomplete`, and a group
PIM policy value that could not be read is never taken as `false`. A policy's fixed expiration is
read and exported as an ISO 8601 UTC string. A catalog named like an object id is exported by id,
and the validator warns on such a name.

An `accessReviews` entry can declare `directoryRole` (a role name or id) for a review of the users
assigned to one Microsoft Entra directory role, and `New-OERAccessReviewDefinition` takes
`-DirectoryRole`. Review definitions now carry `PrincipalScopes` and `ResourceScopes`. The inventory
writes such a review and skips, counting them, role reviews of only eligible or only active
assignments or in another form; a live review of another role or form under the entry's name is
refused with `AccessReviewScopeMismatch`.