Omnicit.EntraRBAC.psd1
|
@{ RootModule = 'Omnicit.EntraRBAC.psm1' ModuleVersion = '1.5.0' CompatiblePSEditions = @('Core') GUID = '7b9e4a1c-2d6f-4f3a-9c8b-1e5d0a7c3f42' Author = 'Omnicit AB / Philip Haglund' CompanyName = 'Omnicit' Copyright = '(c) 2026 Omnicit AB' Description = 'Manage Entra ID and Azure RBAC building blocks across tenants: Entra ID groups, PIM, Administrative Units, Entitlement Management, Access Reviews, Azure resources and RBAC, plus a JSON inventory and declarative apply engine.' PowerShellVersion = '7.6' RequiredModules = @( @{ ModuleName = 'AzAuth'; ModuleVersion = '2.11.0' } @{ ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '2.36.0' } ) # Loaded via Update-TypeData in suffix.ps1 (Remove-Module does not clean type data). TypesToProcess = @() FormatsToProcess = @('Formats/Omnicit.EntraRBAC.Format.ps1xml') FunctionsToExport = @('Add-OERAccessPackageResourceRole','Add-OERAdministrativeUnitMember','Add-OERAdministrativeUnitScopedRole','Add-OERCatalogResource','Add-OERGroupEligibility','Add-OERGroupMember','Connect-OER','Disable-OEREligibleRoleAssignment','Disconnect-OER','Enable-OEREligibleRoleAssignment','Export-OERInventory','Get-OERAccessPackage','Get-OERAccessPackageAssignment','Get-OERAccessPackageAssignmentPolicy','Get-OERAccessPackageResourceRole','Get-OERAccessReviewDefinition','Get-OERAccessReviewInstance','Get-OERAccessReviewInstanceDecision','Get-OERActiveDirectoryRoleAssignment','Get-OERActiveRoleAssignment','Get-OERAdministrativeUnit','Get-OERAdministrativeUnitScopedRole','Get-OERAuthenticationContext','Get-OERCatalog','Get-OERCatalogResource','Get-OERConfiguration','Get-OERDirectoryRoleManagementPolicy','Get-OEREligibleDirectoryRoleAssignment','Get-OEREligibleRoleAssignment','Get-OERGroup','Get-OERGroupEligibility','Get-OERGroupMember','Get-OERGroupPimPolicy','Get-OERInventory','Get-OERManagementGroup','Get-OERRequiredScope','Get-OERResource','Get-OERResourceGroup','Get-OERRoleAssignment','Get-OERRoleDefinition','Get-OERRoleManagementPolicy','Get-OERSubscription','Invoke-OERAccessReviewInstanceDecision','Invoke-OERStructure','New-OERAccessPackage','New-OERAccessPackageApprovalStage','New-OERAccessPackageAssignment','New-OERAccessPackageAssignmentPolicy','New-OERAccessPackageRequestorScope','New-OERAccessPackageRequestorSettings','New-OERAccessReviewDefinition','New-OERAccessReviewStage','New-OERActiveDirectoryRoleAssignment','New-OERActiveRoleAssignment','New-OERAdministrativeUnit','New-OERCatalog','New-OERConfiguration','New-OEREligibleDirectoryRoleAssignment','New-OEREligibleRoleAssignment','New-OERGroup','New-OERPolicyNotificationRule','New-OERResourceGroup','New-OERRoleAssignment','Remove-OERAccessPackage','Remove-OERAccessPackageAssignment','Remove-OERAccessPackageAssignmentPolicy','Remove-OERAccessPackageResourceRole','Remove-OERAccessReviewDefinition','Remove-OERActiveDirectoryRoleAssignment','Remove-OERActiveRoleAssignment','Remove-OERAdministrativeUnit','Remove-OERAdministrativeUnitMember','Remove-OERAdministrativeUnitScopedRole','Remove-OERCatalog','Remove-OERCatalogResource','Remove-OERConfiguration','Remove-OEREligibleDirectoryRoleAssignment','Remove-OEREligibleRoleAssignment','Remove-OERGroup','Remove-OERGroupEligibility','Remove-OERGroupMember','Remove-OERResourceGroup','Remove-OERRoleAssignment','Send-OERAccessReviewReminder','Set-OERAccessPackage','Set-OERAccessPackageAssignmentPolicy','Set-OERAccessReviewDefinition','Set-OERAdministrativeUnit','Set-OERCatalog','Set-OERConfiguration','Set-OERDirectoryRoleManagementPolicy','Set-OERGroup','Set-OERGroupPimPolicy','Set-OERResourceGroup','Set-OERRoleAssignment','Set-OERRoleManagementPolicy','Stop-OERAccessReviewInstance','Test-OERStructure') CmdletsToExport = @() VariablesToExport = @() AliasesToExport = @() PrivateData = @{ PSData = @{ Tags = @('EntraID', 'Azure', 'RBAC', 'PIM', 'Identity', 'Governance', 'PSEdition_Core', 'Windows', 'Linux', 'MacOS') ProjectUri = 'https://github.com/Omnicit/Omnicit.EntraRBAC' LicenseUri = 'https://github.com/Omnicit/Omnicit.EntraRBAC/blob/main/LICENSE' IconUri = 'https://raw.githubusercontent.com/Omnicit/Omnicit.EntraRBAC/main/assets/icon.png' RequireLicenseAcceptance = $false ReleaseNotes = '## [1.5.0] - 2026-11-07 The seven cmdlets that create, remove, activate or deactivate Azure role assignments report a failed role lookup as that failure and an ambiguous name as `AmbiguousName`; `RoleDefinitionNotFound` now means only that no role has that name at the scope. In those and the Azure role management policy cmdlets, an empty or JSON null Azure answer is no longer read as "no such role" or "no such policy" (`PolicyNotFound`) but as a failed read (`ArmPagingIncomplete`): `Get-OERRoleManagementPolicy -AllRolesAtScope` reports `RoleEnumerationFailed` instead of a parameter binding error, and `Get-OERInventory -CommonRoles` names the section unread instead of skipping each role. `Get-OERInventory` and `Export-OERInventory` write a group, service principal or application whose display name looks like an object id by its id wherever the document references it, and leave a group''s own `groups` entry out, named as unread, since applying such a name reads it as an object id. An access review whose namesake the export skips is now left out and counted as a shared name. An assignment policy update carries every setting the live policy has, an empty list or `false` included. `Set-OERResourceGroup` refuses a read without a location (`ResourceGroupValueUnknown`), `Get-OERRoleDefinition -Role` reports an empty Azure answer as `ArmPagingIncomplete`, and a group PIM policy value that could not be read is never taken as `false`. A policy''s fixed expiration is read and exported as an ISO 8601 UTC string. A catalog named like an object id is exported by id, and the validator warns on such a name. An `accessReviews` entry can declare `directoryRole` (a role name or id) for a review of the users assigned to one Microsoft Entra directory role, and `New-OERAccessReviewDefinition` takes `-DirectoryRole`. Review definitions now carry `PrincipalScopes` and `ResourceScopes`. The inventory writes such a review and skips, counting them, role reviews of only eligible or only active assignments or in another form; a live review of another role or form under the entry''s name is refused with `AccessReviewScopeMismatch`. Most errors the module raises internally, such as an unreadable structure document or naming standard, an invalid duration, name or schedule, or an incomplete Microsoft Graph answer, now carry their own error id and category instead of their message as the id wherever such a record reaches you; the messages are unchanged. ' Prerelease = '' } } } |