Skip to content

Commit 22840fb

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #249590 from markwahl-msft/mwahl-em-psh2a
Entra ID: EM convert some beta examples to v1 and to psh v2 syntax
2 parents 3a10128 + aa4ab89 commit 22840fb

5 files changed

+122
-93
lines changed

‎articles/active-directory/governance/entitlement-management-access-package-assignments.md

Lines changed: 39 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -63,14 +63,13 @@ You can also retrieve assignments in an access package using Microsoft Graph. A
6363

6464
### View assignments with PowerShell
6565

66-
You can perform this query in PowerShell with the `Get-MgEntitlementManagementAccessPackageAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x. This cmdlet takes as a parameter the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet.
66+
You can perform this query in PowerShell with the `Get-MgEntitlementManagementAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.1.x or later module version. This script illustrates using the Microsoft Graph PowerShell cmdlets module version 2.4.0. This cmdlet takes as a parameter the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet.
6767

6868
```powershell
6969
Connect-MgGraph -Scopes "EntitlementManagement.Read.All"
70-
Select-MgProfile -Name "beta"
71-
$accesspackage = Get-MgEntitlementManagementAccessPackage -DisplayNameEq "Marketing Campaign"
72-
$assignments = Get-MgEntitlementManagementAccessPackageAssignment -AccessPackageId $accesspackage.Id -ExpandProperty target -All -ErrorAction Stop
73-
$assignments | ft Id,AssignmentState,TargetId,{$_.Target.DisplayName}
70+
$accesspackage = Get-MgEntitlementManagementAccessPackage -Filter "displayName eq 'Marketing Campaign'"
71+
$assignments = Get-MgEntitlementManagementAssignment -AccessPackageId $accesspackage.Id -ExpandProperty target -All -ErrorAction Stop
72+
$assignments | ft Id,state,{$_.Target.id},{$_.Target.displayName}
7473
```
7574

7675
## Directly assign a user
@@ -153,20 +152,25 @@ You can also directly assign a user to an access package using Microsoft Graph.
153152

154153
### Assign a user to an access package with PowerShell
155154

156-
You can assign a user to an access package in PowerShell with the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x. This cmdlet takes as parameters
157-
* the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet,
158-
* the access package assignment policy ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackageAssignmentPolicy`cmdlet,
159-
* the object ID of the target user, if the user is already present in your directory.
155+
You can assign a user to an access package in PowerShell with the `New-MgEntitlementManagementAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.1.x or later module version. This script illustrates using the Microsoft Graph PowerShell cmdlets module version 2.4.0.
160156

161157
```powershell
162158
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
163-
Select-MgProfile -Name "beta"
164-
$accesspackage = Get-MgEntitlementManagementAccessPackage -DisplayNameEq "Marketing Campaign" -ExpandProperty "accessPackageAssignmentPolicies"
165-
$policy = $accesspackage.AccessPackageAssignmentPolicies[0]
166-
$req = New-MgEntitlementManagementAccessPackageAssignmentRequest -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -TargetId "a43ee6df-3cc5-491a-ad9d-ea964ef8e464"
159+
$accesspackage = Get-MgEntitlementManagementAccessPackage -Filter "displayname eq 'Marketing Campaign'" -ExpandProperty assignmentpolicies
160+
$policy = $accesspackage.AssignmentPolicies[0]
161+
$userid = "cdbdf152-82ce-479c-b5b8-df90f561d5c7"
162+
$params = @{
163+
requestType = "adminAdd"
164+
assignment = @{
165+
targetId = $userid
166+
assignmentPolicyId = $policy.Id
167+
accessPackageId = $accesspackage.Id
168+
}
169+
}
170+
New-MgEntitlementManagementAssignmentRequest -BodyParameter $params
167171
```
168172

169-
You can also assign multiple users that are in your directory to an access package using PowerShell with the `New-MgEntitlementManagementAccessPackageAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.1 or later. This cmdlet takes as parameters
173+
You can also assign multiple users that are in your directory to an access package using PowerShell with the `New-MgBetaEntitlementManagementAccessPackageAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.4.0 or later. This cmdlet takes as parameters
170174
* the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet,
171175
* the access package assignment policy ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackageAssignmentPolicy`cmdlet,
172176
* the object IDs of the target users, either as an array of strings, or as a list of user members returned from the `Get-MgGroupMember` cmdlet.
@@ -175,24 +179,23 @@ For example, if you want to ensure all the users who are currently members of a
175179

176180
```powershell
177181
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All,Directory.Read.All"
178-
Select-MgProfile -Name "beta"
179-
$members = Get-MgGroupMember -GroupId "a34abd69-6bf8-4abd-ab6b-78218b77dc15"
180-
$accesspackage = Get-MgEntitlementManagementAccessPackage -DisplayNameEq "Marketing Campaign" -ExpandProperty "accessPackageAssignmentPolicies"
181-
$policy = $accesspackage.AccessPackageAssignmentPolicies[0]
182-
$req = New-MgEntitlementManagementAccessPackageAssignment -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -RequiredGroupMember $members
182+
$members = Get-MgGroupMember -GroupId "a34abd69-6bf8-4abd-ab6b-78218b77dc15" -All
183+
184+
$accesspackage = Get-MgEntitlementManagementAccessPackage -Filter "displayname eq 'Marketing Campaign'" -ExpandProperty "assignmentPolicies"
185+
$policy = $accesspackage.AssignmentPolicies[0]
186+
$req = New-MgBetaEntitlementManagementAccessPackageAssignment -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -RequiredGroupMember $members
183187
```
184188

185-
If you wish to add an assignment for a user who is not yet in your directory, you can use the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x. This cmdlet takes as parameters
189+
If you wish to add an assignment for a user who is not yet in your directory, you can use the `New-MgBetaEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 2.4.0. This cmdlet takes as parameters
186190
* the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet,
187191
* the access package assignment policy ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackageAssignmentPolicy`cmdlet,
188192
* the email address of the target user.
189193

190194
```powershell
191195
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
192-
Select-MgProfile -Name "beta"
193-
$accesspackage = Get-MgEntitlementManagementAccessPackage -DisplayNameEq "Marketing Campaign" -ExpandProperty "accessPackageAssignmentPolicies"
194-
$policy = $accesspackage.AccessPackageAssignmentPolicies[0]
195-
$req = New-MgEntitlementManagementAccessPackageAssignmentRequest -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -TargetEmail "[email protected]"
196+
$accesspackage = Get-MgEntitlementManagementAccessPackage -Filter "displayname eq 'Marketing Campaign'" -ExpandProperty "assignmentPolicies"
197+
$policy = $accesspackage.AssignmentPolicies[0]
198+
$req = New-MgBetaEntitlementManagementAccessPackageAssignmentRequest -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -TargetEmail "[email protected]"
196199
```
197200

198201
## Remove an assignment
@@ -223,14 +226,21 @@ You can also remove an assignment of a user to an access package using Microsoft
223226

224227
### Remove an assignment with PowerShell
225228

226-
You can remove a user's assignment in PowerShell with the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
229+
You can remove a user's assignment in PowerShell with the `New-MgEntitlementManagementAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.1.x or later module version. This script illustrates using the Microsoft Graph PowerShell cmdlets module version 2.4.0.
227230

228231
```powershell
229232
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
230-
Select-MgProfile -Name "beta"
231-
$assignments = Get-MgEntitlementManagementAccessPackageAssignment -Filter "accessPackageId eq '9f573551-f8e2-48f4-bf48-06efbb37c7b8' and assignmentState eq 'Delivered'" -All -ErrorAction Stop
232-
$toRemove = $assignments | Where-Object {$_.targetId -eq '76fd6e6a-c390-42f0-879e-93ca093321e7'}
233-
$req = New-MgEntitlementManagementAccessPackageAssignmentRequest -AccessPackageAssignmentId $toRemove.Id -RequestType "AdminRemove"
233+
$accessPackageId = "9f573551-f8e2-48f4-bf48-06efbb37c7b8"
234+
$userId = "040a792f-4c5f-4395-902f-f0d9d192ab2c"
235+
$filter = "accessPackage/Id eq '" + $accessPackageId + "' and state eq 'Delivered' and target/objectId eq '" + $userId + "'"
236+
$assignment = Get-MgEntitlementManagementAssignment -Filter $filter -ExpandProperty target -all -ErrorAction stop
237+
if ($assignment -ne $null) {
238+
$params = @{
239+
requestType = "adminRemove"
240+
assignment = @{ id = $assignment.id }
241+
}
242+
New-MgEntitlementManagementAssignmentRequest -BodyParameter $params
243+
}
234244
```
235245

236246
## Next steps

‎articles/active-directory/governance/entitlement-management-access-package-create.md

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -151,18 +151,18 @@ You can create an access package by using Microsoft Graph. A user in an appropri
151151

152152
### Create an access package by using Microsoft PowerShell
153153

154-
You can also create an access package in PowerShell by using the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
154+
You can also create an access package in PowerShell by using the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 2.4.0.
155155

156-
First, retrieve the ID of the catalog (and of the resources and their roles in that catalog) that you want to include in the access package. Use a script similar to the following example:
156+
First, retrieve the ID of the catalog (and of the resource and its roles in that catalog) that you want to include in the access package. Use a script similar to the following example:
157157

158158
```powershell
159159
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
160-
Select-MgProfile -Name "beta"
161-
$catalog = Get-MgEntitlementManagementAccessPackageCatalog -Filter "displayName eq 'Marketing'"
162160
163-
$rsc = Get-MgEntitlementManagementAccessPackageCatalogAccessPackageResource -AccessPackageCatalogId $catalog.Id -Filter "resourceType eq 'Application'" -ExpandProperty "accessPackageResourceScopes"
164-
$filt = "(originSystem eq 'AadApplication' and accessPackageResource/id eq '" + $rsc[0].Id + "')"
165-
$rr = Get-MgEntitlementManagementAccessPackageCatalogAccessPackageResourceRole -AccessPackageCatalogId $catalog.Id -Filter $filt -ExpandProperty "accessPackageResource"
161+
$catalog = Get-MgBetaEntitlementManagementAccessPackageCatalog -Filter "displayName eq 'Marketing'"
162+
163+
$rsc = Get-MgBetaEntitlementManagementAccessPackageCatalogAccessPackageResource -AccessPackageCatalogId $catalog.Id -Filter "resourceType eq 'Application'" -ExpandProperty "accessPackageResourceScopes"
164+
$filt = "(originSystem eq 'AadApplication' and accessPackageResource/id eq '" + $rsc.Id + "')"
165+
$rr = Get-MgBetaEntitlementManagementAccessPackageCatalogAccessPackageResourceRole -AccessPackageCatalogId $catalog.Id -Filter $filt -ExpandProperty "accessPackageResource"
166166
```
167167

168168
Then, create the access package:
@@ -174,10 +174,10 @@ $params = @{
174174
Description = "outside sales representatives"
175175
}
176176
177-
$ap = New-MgEntitlementManagementAccessPackage -BodyParameter $params
177+
$ap = New-MgBetaEntitlementManagementAccessPackage -BodyParameter $params
178178
```
179179

180-
After you create the access package, assign the resource roles to it. For example, if you want to include the second resource role of the first resource returned earlier as a resource role of the new access package, you can use a script similar to this one:
180+
After you create the access package, assign the resource roles to it. For example, if you want to include the second resource role of the resource returned earlier as a resource role of the new access package, you can use a script similar to this one:
181181

182182
```powershell
183183
$rparams = @{
@@ -186,18 +186,18 @@ $rparams = @{
186186
DisplayName = $rr[2].DisplayName
187187
OriginSystem = $rr[2].OriginSystem
188188
AccessPackageResource = @{
189-
Id = $rsc[0].Id
190-
ResourceType = $rsc[0].ResourceType
191-
OriginId = $rsc[0].OriginId
192-
OriginSystem = $rsc[0].OriginSystem
189+
Id = $rsc.Id
190+
ResourceType = $rsc.ResourceType
191+
OriginId = $rsc.OriginId
192+
OriginSystem = $rsc.OriginSystem
193193
}
194194
}
195195
AccessPackageResourceScope = @{
196-
OriginId = $rsc[0].OriginId
197-
OriginSystem = $rsc[0].OriginSystem
196+
OriginId = $rsc.OriginId
197+
OriginSystem = $rsc.OriginSystem
198198
}
199199
}
200-
New-MgEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $ap.Id -BodyParameter $rparams
200+
New-MgBetaEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $ap.Id -BodyParameter $rparams
201201
```
202202

203203
Finally, create the policies. In this policy, only the administrator can assign access, and there are no access reviews. For more examples, see [Create an assignment policy through PowerShell](entitlement-management-access-package-request-policy.md#create-an-access-package-assignment-policy-through-powershell) and [Create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-beta&preserve-view=true).

‎articles/active-directory/governance/entitlement-management-access-package-request-policy.md

Lines changed: 35 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -222,37 +222,49 @@ You can create a policy using Microsoft Graph. A user in an appropriate role wit
222222

223223
### Create an access package assignment policy through PowerShell
224224

225-
You can also create an access package in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
225+
You can also create an access package in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.1.x or later module version.
226226

227-
This script below illustrates using the `beta` profile, to create a policy for direct assignment to an access package. In this policy, only the administrator can assign access, and there are no access reviews. See [Create an automatic assignment policy](entitlement-management-access-package-auto-assignment-policy.md#create-an-access-package-assignment-policy-through-powershell) for an example of how to create an automatic assignment policy, and [create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-beta&preserve-view=true) for more examples.
227+
This script below illustrates creating a policy for direct assignment to an access package. In this policy, only the administrator can assign access, and there are no approvals or access reviews. See [Create an automatic assignment policy](entitlement-management-access-package-auto-assignment-policy.md#create-an-access-package-assignment-policy-through-powershell) for an example of how to create an automatic assignment policy, and [create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-v1.0&preserve-view=true) for more examples.
228228

229229
```powershell
230230
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
231-
Select-MgProfile -Name "beta"
232231
233232
$apid = "cdd5f06b-752a-4c9f-97a6-82f4eda6c76d"
234233
235-
$pparams = @{
236-
AccessPackageId = $apid
237-
DisplayName = "direct"
238-
Description = "direct assignments by administrator"
239-
AccessReviewSettings = $null
240-
RequestorSettings = @{
241-
ScopeType = "NoSubjects"
242-
AcceptRequests = $true
243-
AllowedRequestors = @(
244-
)
245-
}
246-
RequestApprovalSettings = @{
247-
IsApprovalRequired = $false
248-
IsApprovalRequiredForExtension = $false
249-
IsRequestorJustificationRequired = $false
250-
ApprovalMode = "NoApproval"
251-
ApprovalStages = @(
252-
)
253-
}
234+
$params = @{
235+
displayName = "New Policy"
236+
description = "policy for assignment"
237+
allowedTargetScope = "notSpecified"
238+
specificAllowedTargets = @(
239+
)
240+
expiration = @{
241+
endDateTime = $null
242+
duration = $null
243+
type = "noExpiration"
244+
}
245+
requestorSettings = @{
246+
enableTargetsToSelfAddAccess = $false
247+
enableTargetsToSelfUpdateAccess = $false
248+
enableTargetsToSelfRemoveAccess = $false
249+
allowCustomAssignmentSchedule = $true
250+
enableOnBehalfRequestorsToAddAccess = $false
251+
enableOnBehalfRequestorsToUpdateAccess = $false
252+
enableOnBehalfRequestorsToRemoveAccess = $false
253+
onBehalfRequestors = @(
254+
)
255+
}
256+
requestApprovalSettings = @{
257+
isApprovalRequiredForAdd = $false
258+
isApprovalRequiredForUpdate = $false
259+
stages = @(
260+
)
261+
}
262+
accessPackage = @{
263+
id = $apid
264+
}
254265
}
255-
New-MgEntitlementManagementAccessPackageAssignmentPolicy -BodyParameter $pparams
266+
267+
New-MgEntitlementManagementAssignmentPolicy -BodyParameter $params
256268
```
257269

258270
## Prevent requests from users with incompatible access

0 commit comments

Comments
 (0)