Set-PIMAzureResource -approvers is failing with  400 (Bad Request)

Is this issue fixed or still being worked on? If so, do I need to update
the module or anything? I tried running the command yesterday and still
getting the same error. Please advise.
On Mon, Mar 18, 2024 at 1:15 PM Loïc MICHEL @.***>
wrote:

Closed #28
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=5g0vSv8iZiBRR2aCJjjlGlthfxddk7aTzhwI5ljpfpQ74AxSBsBByUcugt0W5sX3&s=s4JOT4_r3KzbMC4XJnzgajU2i05SJmQt0x1e1PS9mLM&e=
as completed via 95c5e0c
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_commit_95c5e0c07452bc3be59c66c49bd7d703c5b908c4&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=5g0vSv8iZiBRR2aCJjjlGlthfxddk7aTzhwI5ljpfpQ74AxSBsBByUcugt0W5sX3&s=vA4JDp90jSRQjBc_T7CKEVw4zETWHg14jOaFwvLbf-I&e=
.
—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23event-2D12158692839&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=5g0vSv8iZiBRR2aCJjjlGlthfxddk7aTzhwI5ljpfpQ74AxSBsBByUcugt0W5sX3&s=1I8gPPPCpf9vmj14RgiVDX8HnkQeBCuv9rXPAj45Siw&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EU4WPIZBLFPFDSYID3YY5DNFAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJSGE2TQNRZGI4DGOI&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=5g0vSv8iZiBRR2aCJjjlGlthfxddk7aTzhwI5ljpfpQ74AxSBsBByUcugt0W5sX3&s=6hkHLXGiA-brb8RLziH6MFhVm_1ISuiYTKqtwzcwGME&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

yes you need to update the module to V1.5.1
update-module easypim

Thank you sir, unfortunately I am still getting the same error message.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ActivationRequirement
$ActivationRequirement -AllowPermanentEligibility $true  -ApprovalRequired
$true -Approvers @(@{"Id"="665fcf13-c34e-4938-be4b-62e9e9d1b935";
"Name"="king"; "Type"="user"}) -Verbose
An exception occured: Response status code does not indicate success: 400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
I updated the module and confirmed to be the version 1.5.1
On Tue, Mar 19, 2024 at 11:50 AM Loïc MICHEL @.***>
wrote:

yes you need to update the module to V1.5.1
update-module easypim
—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007900319&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=Z95DsjS6g7a9xbFFCp9nsTfRn5cGvgZE6ImE2puS5Mgx4jR7mfwI3CK2r9pqOksY&s=qd4CC8LXIZhNX47FbUluyyBlzhy2dKc1pC2KFGTh8K0&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER2HO5JKTHNWQKXOZDYZCCELAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHEYDAMZRHE&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=Z95DsjS6g7a9xbFFCp9nsTfRn5cGvgZE6ImE2puS5Mgx4jR7mfwI3CK2r9pqOksY&s=Sh1q9DLYGoo-pdYyZjaAFiA1gVsZSnWT5dleHH71Lqs&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

I cant repro this issue now, what do you have in $ActivationRequirement  ? can you share the verbose output?

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName  -ApprovalRequired $true -Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE:  #1 Get role definition for the role Contributor assignable at the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c
VERBOSE:  #2 Get the Assignment for Contributor at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
VERBOSE:
request body:
VERBOSE: request URI :
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
VERBOSE: >> Getting access token
VERBOSE: >> policy ID =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21
VERBOSE:  #3 get role policy at
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE:
request body:
VERBOSE: request URI :
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

        {
            "id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
            "description": "king",
            "isBackup": false,
            "userType": "user"
        }

        ],
        "escalationApprovers":[]
    }]
}

}
VERBOSE: Performing the operation "Updating policy" on target "Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

        {
            "id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
            "description": "king",
            "isBackup": false,
            "userType": "user"
        }

        ],
        "escalationApprovers":[]
    }]
}

}],
"level": "Assignment"
}
}
VERBOSE: request URI :
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate success: 400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in $ActivationRequirement ?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

still working on my side. Are you sure the user objectID is correct?
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true -Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor assignable at the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c
VERBOSE: #2 Get the Assignment for Contributor at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
VERBOSE: >> Getting access token
VERBOSE: >> policy ID =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21
VERBOSE: #3 get role policy at
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate success: 400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in $ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

OK I think I found the issue : type is case sensitive you must use "User"
instead of "user", I will see if I can automatically use the correct case
;)
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true -Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor assignable at the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c
VERBOSE: #2 Get the Assignment for Contributor at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
VERBOSE: >> Getting access token
VERBOSE: >> policy ID =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21
VERBOSE: #3 get role policy at
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate success: 400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in $ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

Awesome !! That was the culprit and after changing to User, the issue is
fixed. Thanks a lot ! : -)
On Tue, Mar 19, 2024 at 1:22 PM Loïc MICHEL @.***>
wrote:

OK I think I found the issue : type is case sensitive you must use "User"
instead of "user", I will see if I can automatically use the correct case
;)
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true -Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor assignable at
the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c

VERBOSE: #2 Get the Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21

VERBOSE: #3 get role policy at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate success:
400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in
$ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762,
or unsubscribe
<
https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI>

.
You are receiving this because you modified the open/close state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008061019&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=fcLWEmhEb0tK3_Kt0eAWTD0Z5BLBkI9XNpTLzhCTO7Y&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBHASZBZAW5TLKQIDYZCM65AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA3DCMBRHE&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=39hm6kJKq6BiONHwJUssFZ7xN-J89lnRO-x6J7goiLE&e=
.
 I used -AllowPermanentEligibility $true but it
doesn't change that.
[image: image.png]
On Tue, Mar 19, 2024 at 1:39 PM Shafiqullah Faizi @.***> wrote:

Awesome !! That was the culprit and after changing to User, the issue is
fixed. Thanks a lot ! : -)
On Tue, Mar 19, 2024 at 1:22 PM Loïc MICHEL @.***>
wrote:

OK I think I found the issue : type is case sensitive you must use "User"
instead of "user", I will see if I can automatically use the correct case
;)
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true -Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor assignable at
the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c

VERBOSE: #2 Get the Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21

VERBOSE: #3 get role policy at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate success:
400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in
$ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762,

or unsubscribe
<
https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008061019&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=fcLWEmhEb0tK3_Kt0eAWTD0Z5BLBkI9XNpTLzhCTO7Y&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBHASZBZAW5TLKQIDYZCM65AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA3DCMBRHE&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=39hm6kJKq6BiONHwJUssFZ7xN-J89lnRO-x6J7goiLE&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

--
Regards,
Shafiq Faizi
Cloud Technologies

Sorry no image here:)
After configuring the role setting to allow permanent eligibility, you need
to create a new assignment (could be eligible or active) and use the
-permanent switch as described in the doc :
New‐PIMAzureResourceActiveAssignment
· kayasax/EasyPIM Wiki (github.com)
https://github.com/kayasax/EasyPIM/wiki/New‐PIMAzureResourceActiveAssignment
Le mar. 19 mars 2024 à 21:46, sfaizi90 @.***> a écrit :

Question, Do you know what command or flag i can use to make this
Permanent
eligible as highlighted? I used -AllowPermanentEligibility $true but it
doesn't change that.
[image: image.png]
On Tue, Mar 19, 2024 at 1:39 PM Shafiqullah Faizi @.***> wrote:

Awesome !! That was the culprit and after changing to User, the issue is
fixed. Thanks a lot ! : -)
On Tue, Mar 19, 2024 at 1:22 PM Loïc MICHEL @.***>
wrote:

OK I think I found the issue : type is case sensitive you must use
"User"
instead of "user", I will see if I can automatically use the correct
case
;)
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true
-Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor assignable
at
the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c

VERBOSE: #2 Get the Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21

VERBOSE: #3 get role policy at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate success:
400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in
$ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762,

or unsubscribe
<

https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008061019&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=fcLWEmhEb0tK3_Kt0eAWTD0Z5BLBkI9XNpTLzhCTO7Y&e=>,

or unsubscribe
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBHASZBZAW5TLKQIDYZCM65AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA3DCMBRHE&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=39hm6kJKq6BiONHwJUssFZ7xN-J89lnRO-x6J7goiLE&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008098528,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJYNCGC2SXNQ7ZVZ4GDYZCPY3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA4TQNJSHA
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

Interesting, I am trying to make the eligible Assignment role to be
permanent vs the active assignment. When I run the following command, its
erroring out as follow. Though I am trying to eligible one, but it
references the active one, something i dont want to use.
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID     -subscriptionID $subscriptionId
-rolename $roleName     -principalID $ObjectID
-duration $duration `
-permanent
Error : An exception occured: ERROR : The role Contributor does not allow
permanent active assignment, exiting
On Tue, Mar 19, 2024 at 2:13 PM Loïc MICHEL @.***>
wrote:

Sorry no image here:)
After configuring the role setting to allow permanent eligibility, you
need
to create a new assignment (could be eligible or active) and use the
-permanent switch as described in the doc :
New‐PIMAzureResourceActiveAssignment
· kayasax/EasyPIM Wiki (github.com)
<
https://github.com/kayasax/EasyPIM/wiki/New‐PIMAzureResourceActiveAssignment>
Le mar. 19 mars 2024 à 21:46, sfaizi90 @.***> a écrit :

Question, Do you know what command or flag i can use to make this
Permanent
eligible as highlighted? I used -AllowPermanentEligibility $true but it
doesn't change that.
[image: image.png]
On Tue, Mar 19, 2024 at 1:39 PM Shafiqullah Faizi @.***> wrote:

Awesome !! That was the culprit and after changing to User, the issue
is
fixed. Thanks a lot ! : -)
On Tue, Mar 19, 2024 at 1:22 PM Loïc MICHEL @.***>
wrote:

OK I think I found the issue : type is case sensitive you must use
"User"
instead of "user", I will see if I can automatically use the correct
case
;)
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true
-Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor assignable
at
the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c

VERBOSE: #2 Get the Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21

VERBOSE: #3 get role policy at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate
success:
400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in
$ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
<
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762>,

or unsubscribe
<

https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008061019&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=fcLWEmhEb0tK3_Kt0eAWTD0Z5BLBkI9XNpTLzhCTO7Y&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBHASZBZAW5TLKQIDYZCM65AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA3DCMBRHE&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=39hm6kJKq6BiONHwJUssFZ7xN-J89lnRO-x6J7goiLE&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008098528,
or unsubscribe
<
https://github.com/notifications/unsubscribe-auth/AAJPFJYNCGC2SXNQ7ZVZ4GDYZCPY3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA4TQNJSHA>

.
You are receiving this because you modified the open/close state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008145008&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=p7VYK7O4a18ieWMYJxOYe6qtj4DyLf9AK4mVJdVo_eHs9yAxsKRlVQQmXLqcErJP&s=aEbVnpcMOXnSdZQpRReePMHahWhfkGNv3nrfNNYDIHE&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EWF5SPBGYYICYNUF3LYZCS5XAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGE2DKMBQHA&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=p7VYK7O4a18ieWMYJxOYe6qtj4DyLf9AK4mVJdVo_eHs9yAxsKRlVQQmXLqcErJP&s=4AA945nksMho7m9fkqx_a32RPunfnwxho0IusWTwzXw&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

Looks like i figured out a workaround, which is before making the eligible
assignment as permanent, I first have to allow active assignment as $true
to make the command work. I can later make the active assignment set back
to $false. It would be nice to have the eligible assignment set to
permanent without enabling the active assignment.
On Tue, Mar 19, 2024 at 3:15 PM Shafiqullah Faizi @.***> wrote:

Interesting, I am trying to make the eligible Assignment role to be
permanent vs the active assignment. When I run the following command, its
erroring out as follow. Though I am trying to eligible one, but it
references the active one, something i dont want to use.
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID     -subscriptionID $subscriptionId
-rolename $roleName     -principalID $ObjectID
-duration $duration `
-permanent
Error : An exception occured: ERROR : The role Contributor does not allow
permanent active assignment, exiting
On Tue, Mar 19, 2024 at 2:13 PM Loïc MICHEL @.***>
wrote:

Sorry no image here:)
After configuring the role setting to allow permanent eligibility, you
need
to create a new assignment (could be eligible or active) and use the
-permanent switch as described in the doc :
New‐PIMAzureResourceActiveAssignment
· kayasax/EasyPIM Wiki (github.com)
<
https://github.com/kayasax/EasyPIM/wiki/New‐PIMAzureResourceActiveAssignment>
Le mar. 19 mars 2024 à 21:46, sfaizi90 @.***> a écrit :

Question, Do you know what command or flag i can use to make this
Permanent
eligible as highlighted? I used -AllowPermanentEligibility $true but it
doesn't change that.
[image: image.png]
On Tue, Mar 19, 2024 at 1:39 PM Shafiqullah Faizi @.***> wrote:

Awesome !! That was the culprit and after changing to User, the issue
is
fixed. Thanks a lot ! : -)
On Tue, Mar 19, 2024 at 1:22 PM Loïc MICHEL @.***>
wrote:

OK I think I found the issue : type is case sensitive you must use
"User"
instead of "user", I will see if I can automatically use the correct
case
;)
Le mar. 19 mars 2024 à 20:56, sfaizi90 @.***> a écrit :

Here you go. Appreciate your help.
$ActivationRequirement = "Justification", "Ticketing",
"MultiFactorAuthentication"
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -ApprovalRequired $true
-Approvers
@(@{"Id"="175fcf13-c34e-4938-be4b-62e9e9d1b907"; "Name"="king";
"Type"="user"}) -Verbose
VERBOSE: #1 Get role definition for the role Contributor
assignable
at
the
scope subscriptions/cdba4838-0335-49c9-8c67-4441dbe282dd at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c

VERBOSE: #2 Get the Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21

VERBOSE: #3 get role policy at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE:

request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
VERBOSE: Set-Approval
VERBOSE: All rules: {
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[
{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}
VERBOSE: Performing the operation "Updating policy" on target
"Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [
{
"id":"Approval_EndUser_Assignment",
"ruleType":"RoleManagementPolicyApprovalRule",
"target":{
"caller":"EndUser",
"operations":["All"],
"level":"Assignment"
},
"setting":{
"isApprovalRequired":"true",
"isApprovalRequiredForExtension":false,
"isRequestorJustificationRequired":true,
"approvalMode":"SingleStage",
"approvalStages":[{
"approvalStageTimeOutInDays":1,
"isApproverJustificationRequired":true,
"escalationTimeInMinutes":0,
"isEscalationEnabled":false,
"primaryApprovers":[

{
"id": "175fcf13-c34e-4938-be4b-62e9e9d1b907",
"description": "king",
"isBackup": false,
"userType": "user"
}
],
"escalationApprovers":[]
}]
}
}],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe444dd/providers/Microsoft.Authorization/roleManagementPolicies/73b2069a-1599-4c4e-9f60-e9179fadeb21/?api-version=2020-10-01

VERBOSE: >> Getting access token
An exception occured: Response status code does not indicate
success:
400
(Bad Request).
Details:
{
"error": {
"code": "InvalidPolicy",
"message": "The policy is invalid."
}
}
On Tue, Mar 19, 2024 at 12:34 PM Loïc MICHEL @.***>
wrote:

I cant repro this issue now, what do you have in
$ActivationRequirement
?
can you share the verbose output?
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2007970610&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=PPUmC_PT8u6dUrd1y6WeZLYDt6qoTMT1Mtkrf6KdaQ8&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ER3FHCM6N266RAZ5E3YZCHL3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBXHE3TANRRGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=rz_ZLnBnasHfpIt3buriMJ2V34dkJrmglI8xg9f1vsCcGphqmgIlWSmDjT1dqtZc&s=24vIf-JrIzBdaNKNxf6_GzjUI44wHCSBeqdfSOVnJJI&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
<
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008006762>,

or unsubscribe
<

https://github.com/notifications/unsubscribe-auth/AAJPFJ3LXYD35TV5FGANTVLYZCKABAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGAYDMNZWGI>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008061019&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=fcLWEmhEb0tK3_Kt0eAWTD0Z5BLBkI9XNpTLzhCTO7Y&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBHASZBZAW5TLKQIDYZCM65AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA3DCMBRHE&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=CN2fFGimYJY703mIunzWClxdXxNElCdtMXP77xPXJzmbGqIb0hwi5SEks8GznIDS&s=39hm6kJKq6BiONHwJUssFZ7xN-J89lnRO-x6J7goiLE&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2008098528,

or unsubscribe
<
https://github.com/notifications/unsubscribe-auth/AAJPFJYNCGC2SXNQ7ZVZ4GDYZCPY3AVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGA4TQNJSHA>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2008145008&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=p7VYK7O4a18ieWMYJxOYe6qtj4DyLf9AK4mVJdVo_eHs9yAxsKRlVQQmXLqcErJP&s=aEbVnpcMOXnSdZQpRReePMHahWhfkGNv3nrfNNYDIHE&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EWF5SPBGYYICYNUF3LYZCS5XAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBYGE2DKMBQHA&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=p7VYK7O4a18ieWMYJxOYe6qtj4DyLf9AK4mVJdVo_eHs9yAxsKRlVQQmXLqcErJP&s=4AA945nksMho7m9fkqx_a32RPunfnwxho0IusWTwzXw&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

--
Regards,
Shafiq Faizi
Cloud Technologies

This is not expected, and I am not able to reproduce.
After allowing permanent assignement please check the configuration is correctly applied:
 set-pimazureResourcePolicy -tenantID $tenantID -subscriptionID $subscriptionId -rolename "contributor" -AllowPermanentEligibility $true
then
 (get-pimazureResourcePolicy -tenantID $tenantID -subscriptionID $subscriptionId -rolename "contributor").AllowPermanentEligibleAssignment  should be true

Let me explain a bit if I can:
When I run this command, it works fine and I can confirm the value to be
true as you suggested.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName  -AllowPermanentEligibility $true
Then I run the following command to make it permanent on the PIM settings,
but I get an error.
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID  -duration
$duration -permanent
Error: An exception occured: ERROR : Contributor does not allow permanent
active assignment, exiting.
My workaround is:
I ran
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName  -AllowPermanentActiveAssignment $true
to make the following work
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID  -duration
$duration -permanent
and then I set back  -AllowPermanentActiveAssignment $true to $false as I
don't want active assignment enabled
My question is , since eligible permanent and active permanent are two
separate things, it shouldn't rely on active permanent to be true for the
eligible to work. If you look at the error, I am trying to make eligible as
permanent but it's throwing an error regarding active permanent not being
allowed for the Contributor role. Hope this helps.
On Wed, Mar 20, 2024 at 3:48 AM Loïc MICHEL @.***>
wrote:

This is not expected, and I am not able to reproduce.
After allowing permanent assignement please check the configuration is
correctly applied:
set-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename "contributor" -AllowPermanentEligibility $true
then
(get-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename "contributor").AllowPermanentEligibleAssignment
should be true
—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2009258230&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=TA9nznMrVN3b5I379eM3F_C5w89afgvsgcWAHFW6kQc&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBM7VX5MQYWXGPR7LYZFSORAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBZGI2TQMRTGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=ehFYYM5lSSHNRWRjEbjGAmCR9GBm_REPNquSNqth68s&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

ok found the issue, will be resolved with V1.5.2
Le mer. 20 mars 2024 à 18:06, sfaizi90 @.***> a écrit :

Let me explain a bit if I can:
When I run this command, it works fine and I can confirm the value to be
true as you suggested.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
Then I run the following command to make it permanent on the PIM settings,
but I get an error.
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID -duration
$duration -permanent
Error: An exception occured: ERROR : Contributor does not allow permanent
active assignment, exiting.
My workaround is:
I ran
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentActiveAssignment $true
to make the following work
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID -duration
$duration -permanent
and then I set back -AllowPermanentActiveAssignment $true to $false as I
don't want active assignment enabled
My question is , since eligible permanent and active permanent are two
separate things, it shouldn't rely on active permanent to be true for the
eligible to work. If you look at the error, I am trying to make eligible
as
permanent but it's throwing an error regarding active permanent not being
allowed for the Contributor role. Hope this helps.
On Wed, Mar 20, 2024 at 3:48 AM Loïc MICHEL @.***>
wrote:

This is not expected, and I am not able to reproduce.
After allowing permanent assignement please check the configuration is
correctly applied:
set-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename "contributor" -AllowPermanentEligibility $true
then
(get-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename
"contributor").AllowPermanentEligibleAssignment
should be true
—
Reply to this email directly, view it on GitHub
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2009258230&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=TA9nznMrVN3b5I379eM3F_C5w89afgvsgcWAHFW6kQc&e=>,

or unsubscribe
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBM7VX5MQYWXGPR7LYZFSORAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBZGI2TQMRTGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=ehFYYM5lSSHNRWRjEbjGAmCR9GBm_REPNquSNqth68s&e=>

.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010083918,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJ3MHW3CRPLA44C4S3LYZG6YTAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGA4DGOJRHA
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

Thank you sir.
FYI - I am starting to get those error back when running the following
commands. Something probably changed on your end. If so, please let me know.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName  -AllowPermanentEligibility $true
Set-PIMAzureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
-AllowPermanentActiveAssignment $true
Error:
An exception occured: The remote server returned an error: (400) Bad
Request.
Details: {"error":{"code":"InvalidPolicy","message":"The policy is
invalid."}}
Position: At
C:\Users\king\Documents\WindowsPowerShell\Modules\easypim\1.5.1\EasyPIM.psm1:856
char:25

... $response = Invoke-RestMethod -Uri $restUri -Method $method -Headers
...

            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Error, script did not terminate normaly
On Wed, Mar 20, 2024 at 11:38 AM Loïc MICHEL @.***>
wrote:

ok found the issue, will be resolved with V1.5.2
Le mer. 20 mars 2024 à 18:06, sfaizi90 @.***> a écrit :

Let me explain a bit if I can:
When I run this command, it works fine and I can confirm the value to be
true as you suggested.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
Then I run the following command to make it permanent on the PIM
settings,
but I get an error.
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID
-subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID -duration
$duration -permanent
Error: An exception occured: ERROR : Contributor does not allow
permanent
active assignment, exiting.
My workaround is:
I ran
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentActiveAssignment
$true
to make the following work
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID
-subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID -duration
$duration -permanent
and then I set back -AllowPermanentActiveAssignment $true to $false as I
don't want active assignment enabled
My question is , since eligible permanent and active permanent are two
separate things, it shouldn't rely on active permanent to be true for
the
eligible to work. If you look at the error, I am trying to make eligible
as
permanent but it's throwing an error regarding active permanent not
being
allowed for the Contributor role. Hope this helps.
On Wed, Mar 20, 2024 at 3:48 AM Loïc MICHEL @.***>
wrote:

This is not expected, and I am not able to reproduce.
After allowing permanent assignement please check the configuration is
correctly applied:
set-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename "contributor" -AllowPermanentEligibility
$true
then
(get-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename
"contributor").AllowPermanentEligibleAssignment
should be true
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2009258230&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=TA9nznMrVN3b5I379eM3F_C5w89afgvsgcWAHFW6kQc&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBM7VX5MQYWXGPR7LYZFSORAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBZGI2TQMRTGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=ehFYYM5lSSHNRWRjEbjGAmCR9GBm_REPNquSNqth68s&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010083918,
or unsubscribe
<
https://github.com/notifications/unsubscribe-auth/AAJPFJ3MHW3CRPLA44C4S3LYZG6YTAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGA4DGOJRHA>

.
You are receiving this because you modified the open/close state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2010337852&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=9JqBhBObc4toy-CPH-cVfwPeQs_VZskSgjlmPTiJ76boNvcRRqF3VBpvxlfk8LOF&s=hCzZxodnIgHOICzju9Vd-EDBu1htaIT8E05v-bje_2o&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EW4NZUVE3KZHIA5KSLYZHJTPAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGMZTOOBVGI&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=9JqBhBObc4toy-CPH-cVfwPeQs_VZskSgjlmPTiJ76boNvcRRqF3VBpvxlfk8LOF&s=C6H2wcBa9LoW7rfmbBLD40v91woYBpPOw7fEd-nmUn8&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

No change on my side and it is working fine here... can you try to update
and send me the verbose output please?
Le mer. 20 mars 2024 à 20:25, sfaizi90 @.***> a écrit :

Thank you sir.
FYI - I am starting to get those error back when running the following
commands. Something probably changed on your end. If so, please let me
know.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
Set-PIMAzureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
-AllowPermanentActiveAssignment $true
Error:
An exception occured: The remote server returned an error: (400) Bad
Request.
Details: {"error":{"code":"InvalidPolicy","message":"The policy is
invalid."}}
Position: At
C:\Users\king\Documents\WindowsPowerShell\Modules\easypim\1.5.1\EasyPIM.psm1:856
char:25

... $response = Invoke-RestMethod -Uri $restUri -Method $method -Headers
...

Error, script did not terminate normaly
On Wed, Mar 20, 2024 at 11:38 AM Loïc MICHEL @.***>
wrote:

ok found the issue, will be resolved with V1.5.2
Le mer. 20 mars 2024 à 18:06, sfaizi90 @.***> a écrit :

Let me explain a bit if I can:
When I run this command, it works fine and I can confirm the value to
be
true as you suggested.
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
Then I run the following command to make it permanent on the PIM
settings,
but I get an error.
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID
-subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID -duration
$duration -permanent
Error: An exception occured: ERROR : Contributor does not allow
permanent
active assignment, exiting.
My workaround is:
I ran
Set-PIMAzureResourcePolicy -TenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentActiveAssignment
$true
to make the following work
New-PIMAzureResourceEligibleAssignment -TenantID $tenantID
-subscriptionID
$subscriptionId -rolename $roleName -principalID $ObjectID -duration
$duration -permanent
and then I set back -AllowPermanentActiveAssignment $true to $false as
I
don't want active assignment enabled
My question is , since eligible permanent and active permanent are two
separate things, it shouldn't rely on active permanent to be true for
the
eligible to work. If you look at the error, I am trying to make
eligible
as
permanent but it's throwing an error regarding active permanent not
being
allowed for the Contributor role. Hope this helps.
On Wed, Mar 20, 2024 at 3:48 AM Loïc MICHEL @.***>
wrote:

This is not expected, and I am not able to reproduce.
After allowing permanent assignement please check the configuration
is
correctly applied:
set-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename "contributor" -AllowPermanentEligibility
$true
then
(get-pimazureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename
"contributor").AllowPermanentEligibleAssignment
should be true
—
Reply to this email directly, view it on GitHub
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2009258230&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=TA9nznMrVN3b5I379eM3F_C5w89afgvsgcWAHFW6kQc&e=>,

or unsubscribe
<

https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EQBM7VX5MQYWXGPR7LYZFSORAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBZGI2TQMRTGA&d=DwMCaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=imu_u89Bn4gh_40k0yvyztwEr8GMsANkblkjZhyutVC-Uznv1fqh48h9TqwI3bCo&s=ehFYYM5lSSHNRWRjEbjGAmCR9GBm_REPNquSNqth68s&e=>

.
You are receiving this because you are subscribed to this
thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010083918,

or unsubscribe
<

https://github.com/notifications/unsubscribe-auth/AAJPFJ3MHW3CRPLA44C4S3LYZG6YTAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGA4DGOJRHA>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2010337852&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=9JqBhBObc4toy-CPH-cVfwPeQs_VZskSgjlmPTiJ76boNvcRRqF3VBpvxlfk8LOF&s=hCzZxodnIgHOICzju9Vd-EDBu1htaIT8E05v-bje_2o&e=>,

or unsubscribe
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2EW4NZUVE3KZHIA5KSLYZHJTPAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGMZTOOBVGI&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=9JqBhBObc4toy-CPH-cVfwPeQs_VZskSgjlmPTiJ76boNvcRRqF3VBpvxlfk8LOF&s=C6H2wcBa9LoW7rfmbBLD40v91woYBpPOw7fEd-nmUn8&e=>

.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010451327,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJZIXQYYJVDIXSULH5LYZHPENAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGQ2TCMZSG4
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

here you go. Thanks
Set-PIMAzureResourcePolicy -tenantID $tenantID -subscriptionID $subscriptionId -rolename $roleName -AllowPermanentEligibility $true -AllowPermanentActiveAssignment $true -Verbose
VERBOSE:  #1 Get role definition for the role Contributor assignable at the scope subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233 at https://management.azure.com/su
bscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName eq 'Contributor'
VERBOSE:

request body:
VERBOSE: request URI : https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleNam
e eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId = /subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809
VERBOSE:  #2 Get the Assignment for Contributor at https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/ro
leManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId eq '/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630ee
f-f3ab-40ac-bdc4-dd2b7193f809'
VERBOSE:
request body:
VERBOSE: request URI : https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01
&$filter=roleDefinitionId eq '/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809'
VERBOSE: >> Getting access token
VERBOSE: >> policy ID = /subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7967a55
VERBOSE:  #3 get role policy at https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad
28-ddb6d7967a3c/?api-version=2020-10-01
VERBOSE:
request body:
VERBOSE: request URI : https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7
967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Maximum Eligibiliy duration from curent config: PT8H
VERBOSE: Set-EligibilityAssignment: PT8H True
VERBOSE: 1 setting expire to : false
VERBOSE: Maximum Active duration from curent config: P180D
VERBOSE: Set-ActiveAssignment(P180D, True)
VERBOSE: All rules:
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}

VERBOSE: Performing the operation "Udpdating policy" on target "Contributor".
VERBOSE:

request body:
{
"properties": {
"scope": "",
"rules": [

    {
    "isExpirationRequired": false,
    "maximumDuration": "PT8H",
    "id": "Expiration_Admin_Eligibility",
    "ruleType": "RoleManagementPolicyExpirationRule",
    "target": {
      "caller": "Admin",
      "operations": [
        "All"
      ],
      "level": "Eligibility",
      "targetObjects": null,
      "inheritableSettings": null,
      "enforcedSettings": null
    }
}
,
    {
    "isExpirationRequired": false,
    "maximumDuration": "P180D",
    "id": "Expiration_Admin_Assignment",
    "ruleType": "RoleManagementPolicyExpirationRule",
    "target": {
    "caller": "Admin",
    "operations": [
        "All"
    ],
    "level": "Eligibility",
    "targetObjects": null,
    "inheritableSettings": null,
    "enforcedSettings": null
    }
    }
],
      "level": "Assignment"
        }
    }

VERBOSE: request URI : https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7
967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: The remote server returned an error: (400) Bad Request.
Details: {"error":{"code":"InvalidPolicy","message":"The policy is invalid."}}
Position: At C:\Users\king\Documents\WindowsPowerShell\Modules\easypim\1.5.1\EasyPIM.psm1:856 char:25

... $response = Invoke-RestMethod -Uri $restUri -Method $method -Headers  ...

            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Error, script did not terminate normaly

This should be fixed in V1.5.3, hopefully I did not break anything else ^_^.
Sorry for the inconvenience.
Le mer. 20 mars 2024 à 21:23, sfaizi90 @.***> a écrit :

here you go. Thanks
Set-PIMAzureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
-AllowPermanentActiveAssignment $true -Verbose
VERBOSE: #1 https://github.com/kayasax/EasyPIM/issues/1 Get role
definition for the role Contributor assignable at the scope
subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233 at
https://management.azure.com/su
bscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName
eq 'Contributor'
VERBOSE:
request body:
VERBOSE: request URI :
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleNam
e eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809
VERBOSE: #2 https://github.com/kayasax/EasyPIM/issues/2 Get the
Assignment for Contributor at
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/ro
leManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId
eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630ee
f-f3ab-40ac-bdc4-dd2b7193f809'
VERBOSE:
request body:
VERBOSE: request URI :
https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01
&$filter=roleDefinitionId eq
'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809'
VERBOSE: >> Getting access token
VERBOSE: >> policy ID =
/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7967a55
VERBOSE: #3 https://github.com/kayasax/EasyPIM/pull/3 get role policy
at
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad
28-ddb6d7967a3c/?api-version=2020-10-01
VERBOSE:
request body:
VERBOSE: request URI :
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7
967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Maximum Eligibiliy duration from curent config: PT8H
VERBOSE: Set-EligibilityAssignment: PT8H True
VERBOSE: 1 setting expire to : false
VERBOSE: Maximum Active duration from curent config: P180D
VERBOSE: Set-ActiveAssignment(P180D, True)
VERBOSE: All rules:
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
VERBOSE: Performing the operation "Udpdating policy" on target
"Contributor".
VERBOSE:
request body:
{
"properties": {
"scope": "",
"rules": [
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
  "caller": "Admin",
  "operations": [
    "All"
  ],
  "level": "Eligibility",
  "targetObjects": null,
  "inheritableSettings": null,
  "enforcedSettings": null
}

}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
],
"level": "Assignment"
}
}
VERBOSE: request URI :
https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7
967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: The remote server returned an error: (400) Bad
Request.
Details: {"error":{"code":"InvalidPolicy","message":"The policy is
invalid."}}
Position: At
C:\Users\king\Documents\WindowsPowerShell\Modules\easypim\1.5.1\EasyPIM.psm1:856
char:25

... $response = Invoke-RestMethod -Uri $restUri -Method $method
-Headers ...

           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Error, script did not terminate normaly
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010557581,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJ7XKMRD3GUEOVNB3ALYZHV5VAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGU2TONJYGE
.
You are receiving this because you modified the open/close state.Message
ID: @.***>

Thank you , hopefully not :D
I can now confirm that command New-PIMAzureResourceEligibleAssignment
-TenantID $tenantID -subscriptionID $subscriptionId -rolename $roleName
-principalID $ObjectID  -duration $duration -permanent
is working as expected. All other Set commands do not work and still give
me Invalid policy error. Kindly let me know when you fixed it. Cheers.
On Wed, Mar 20, 2024 at 2:38 PM Loïc MICHEL @.***>
wrote:

This should be fixed in V1.5.3, hopefully I did not break anything else
^_^.
Sorry for the inconvenience.
Le mer. 20 mars 2024 à 21:23, sfaizi90 @.***> a écrit :

here you go. Thanks
Set-PIMAzureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
-AllowPermanentActiveAssignment $true -Verbose
VERBOSE: #1 https://github.com/kayasax/EasyPIM/issues/1 Get role
definition for the role Contributor assignable at the scope
subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233 at
https://management.azure.com/su

bscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:
request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleNam

e eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809

VERBOSE: #2 https://github.com/kayasax/EasyPIM/issues/2 Get the
Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/ro

leManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630ee

f-f3ab-40ac-bdc4-dd2b7193f809'
VERBOSE:
request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01

&$filter=roleDefinitionId eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7967a55

VERBOSE: #3 https://github.com/kayasax/EasyPIM/pull/3 get role policy
at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad

28-ddb6d7967a3c/?api-version=2020-10-01
VERBOSE:
request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7

967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Maximum Eligibiliy duration from curent config: PT8H
VERBOSE: Set-EligibilityAssignment: PT8H True
VERBOSE: 1 setting expire to : false
VERBOSE: Maximum Active duration from curent config: P180D
VERBOSE: Set-ActiveAssignment(P180D, True)
VERBOSE: All rules:
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
VERBOSE: Performing the operation "Udpdating policy" on target
"Contributor".
VERBOSE:
request body:
{
"properties": {
"scope": "",
"rules": [
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7

967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: The remote server returned an error: (400) Bad
Request.
Details: {"error":{"code":"InvalidPolicy","message":"The policy is
invalid."}}
Position: At

C:\Users\king\Documents\WindowsPowerShell\Modules\easypim\1.5.1\EasyPIM.psm1:856

char:25

... $response = Invoke-RestMethod -Uri $restUri -Method $method
-Headers ...

Error, script did not terminate normaly

—
Reply to this email directly, view it on GitHub
<https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010557581>,
or unsubscribe
<

https://github.com/notifications/unsubscribe-auth/AAJPFJ7XKMRD3GUEOVNB3ALYZHV5VAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGU2TONJYGE>

.
You are receiving this because you modified the open/close state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2010685373&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=BHQdaHca9K_Ic0J1S3i2VQqKx8-3XpF6gYgXyEgZSSc1B7HQfNvJbE1pAuibx-47&s=xfojzVLX5MRi4xHcFCxfg_e5zONu4AeoWOobuCnq_RU&e=,
or unsubscribe
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ES5LMVIJ3DPFVYUAD3YZH6VHAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGY4DKMZXGM&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=BHQdaHca9K_Ic0J1S3i2VQqKx8-3XpF6gYgXyEgZSSc1B7HQfNvJbE1pAuibx-47&s=MYsVOHqycVpkSvCmEjeq5UuGdSE1JpNWc2UgrOuLFT0&e=
.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies

:O really!?? can you provide an example please?
PS: can you use the "contact owner" link from powershell gallery so we can
communicate directly and more easily?
Thank you.
Le jeu. 21 mars 2024 à 02:27, sfaizi90 @.***> a écrit :

Thank you , hopefully not :D
I can now confirm that command New-PIMAzureResourceEligibleAssignment
-TenantID $tenantID -subscriptionID $subscriptionId -rolename $roleName
-principalID $ObjectID -duration $duration -permanent
is working as expected. All other Set commands do not work and still give
me Invalid policy error. Kindly let me know when you fixed it. Cheers.
On Wed, Mar 20, 2024 at 2:38 PM Loïc MICHEL @.***>
wrote:

This should be fixed in V1.5.3, hopefully I did not break anything else
^_^.
Sorry for the inconvenience.
Le mer. 20 mars 2024 à 21:23, sfaizi90 @.***> a écrit :

here you go. Thanks
Set-PIMAzureResourcePolicy -tenantID $tenantID -subscriptionID
$subscriptionId -rolename $roleName -AllowPermanentEligibility $true
-AllowPermanentActiveAssignment $true -Verbose
VERBOSE: #1 https://github.com/kayasax/EasyPIM/issues/1 Get role
definition for the role Contributor assignable at the scope
subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233 at
https://management.azure.com/su

bscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleName

eq 'Contributor'
VERBOSE:
request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions?api-version=2022-04-01&$filter=roleNam

e eq 'Contributor'
VERBOSE: >> Getting access token
VERBOSE: >> RodeId =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809

VERBOSE: #2 https://github.com/kayasax/EasyPIM/issues/2 Get the
Assignment for Contributor at

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/ro

leManagementPolicyAssignments?api-version=2020-10-01&$filter=roleDefinitionId

eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630ee

f-f3ab-40ac-bdc4-dd2b7193f809'
VERBOSE:
request body:
VERBOSE: request URI :

https://management.azure.com/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicyAssignments?api-version=2020-10-01

&$filter=roleDefinitionId eq

'/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleDefinitions/f6630eef-f3ab-40ac-bdc4-dd2b7193f809'

VERBOSE: >> Getting access token
VERBOSE: >> policy ID =

/subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7967a55

VERBOSE: #3 https://github.com/kayasax/EasyPIM/pull/3 get role
policy
at

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad

28-ddb6d7967a3c/?api-version=2020-10-01
VERBOSE:
request body:
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7

967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
VERBOSE: Maximum Eligibiliy duration from curent config: PT8H
VERBOSE: Set-EligibilityAssignment: PT8H True
VERBOSE: 1 setting expire to : false
VERBOSE: Maximum Active duration from curent config: P180D
VERBOSE: Set-ActiveAssignment(P180D, True)
VERBOSE: All rules:
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
VERBOSE: Performing the operation "Udpdating policy" on target
"Contributor".
VERBOSE:
request body:
{
"properties": {
"scope": "",
"rules": [
{
"isExpirationRequired": false,
"maximumDuration": "PT8H",
"id": "Expiration_Admin_Eligibility",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
,
{
"isExpirationRequired": false,
"maximumDuration": "P180D",
"id": "Expiration_Admin_Assignment",
"ruleType": "RoleManagementPolicyExpirationRule",
"target": {
"caller": "Admin",
"operations": [
"All"
],
"level": "Eligibility",
"targetObjects": null,
"inheritableSettings": null,
"enforcedSettings": null
}
}
],
"level": "Assignment"
}
}
VERBOSE: request URI :

https://management.azure.com//subscriptions/cdba4838-0335-49c9-8c67-8641dbe28233/providers/Microsoft.Authorization/roleManagementPolicies/b43045b6-5fa5-4210-ad28-ddb6d7

967a3c/?api-version=2020-10-01
VERBOSE: >> Getting access token
An exception occured: The remote server returned an error: (400) Bad
Request.
Details: {"error":{"code":"InvalidPolicy","message":"The policy is
invalid."}}
Position: At

C:\Users\king\Documents\WindowsPowerShell\Modules\easypim\1.5.1\EasyPIM.psm1:856

char:25

... $response = Invoke-RestMethod -Uri $restUri -Method $method
-Headers ...

Error, script did not terminate normaly

—
Reply to this email directly, view it on GitHub
<https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2010557581>,

or unsubscribe
<

https://github.com/notifications/unsubscribe-auth/AAJPFJ7XKMRD3GUEOVNB3ALYZHV5VAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGU2TONJYGE>

.
You are receiving this because you modified the open/close
state.Message
ID: @.***>

—
Reply to this email directly, view it on GitHub
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kayasax_EasyPIM_issues_28-23issuecomment-2D2010685373&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=BHQdaHca9K_Ic0J1S3i2VQqKx8-3XpF6gYgXyEgZSSc1B7HQfNvJbE1pAuibx-47&s=xfojzVLX5MRi4xHcFCxfg_e5zONu4AeoWOobuCnq_RU&e=>,

or unsubscribe
<
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BGYT2ES5LMVIJ3DPFVYUAD3YZH6VHAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJQGY4DKMZXGM&d=DwMFaQ&c=pApUd0AUA6FmKRo01iR_VA&r=72P7tmqKAJiXx9yWGJmHQ4NBqLfpmrNtGmZlq6kaI8I&m=BHQdaHca9K_Ic0J1S3i2VQqKx8-3XpF6gYgXyEgZSSc1B7HQfNvJbE1pAuibx-47&s=MYsVOHqycVpkSvCmEjeq5UuGdSE1JpNWc2UgrOuLFT0&e=>

.
You are receiving this because you are subscribed to this thread.Message
ID: @.***>

--
Regards,
Shafiq Faizi
Cloud Technologies
—
Reply to this email directly, view it on GitHub
https://github.com/kayasax/EasyPIM/issues/28#issuecomment-2011019272,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJPFJ7B6CNY5I772FANWW3YZIZQZAVCNFSM6AAAAABEZH3SJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJRGAYTSMRXGI
.
You are receiving this because you modified the open/close state.Message
ID: @.***>