Skip to content

Commit f186b1c

Browse files
Merge pull request #247443 from markwahl-msft/mwahl-em-pshb1
EM update for Graph Psh 2.x.x
2 parents dcf28a2 + bf8e2ac commit f186b1c

9 files changed

+16
-21
lines changed

articles/active-directory/governance/entitlement-management-access-package-assignments.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ You can also retrieve assignments in an access package using Microsoft Graph. A
6161

6262
### View assignments with PowerShell
6363

64-
You can perform this query in PowerShell with the `Get-MgEntitlementManagementAccessPackageAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or later. This cmdlet takes as a parameter the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet.
64+
You can perform this query in PowerShell with the `Get-MgEntitlementManagementAccessPackageAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x. This cmdlet takes as a parameter the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet.
6565

6666
```powershell
6767
Connect-MgGraph -Scopes "EntitlementManagement.Read.All"
@@ -147,7 +147,7 @@ You can also directly assign a user to an access package using Microsoft Graph.
147147

148148
### Assign a user to an access package with PowerShell
149149

150-
You can assign a user to an access package in PowerShell with the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or later. This cmdlet takes as parameters
150+
You can assign a user to an access package in PowerShell with the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x. This cmdlet takes as parameters
151151
* the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet,
152152
* the access package assignment policy ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackageAssignmentPolicy`cmdlet,
153153
* the object ID of the target user, if the user is already present in your directory.
@@ -176,7 +176,7 @@ $policy = $accesspackage.AccessPackageAssignmentPolicies[0]
176176
$req = New-MgEntitlementManagementAccessPackageAssignment -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -RequiredGroupMember $members
177177
```
178178

179-
If you wish to add an assignment for a user who is not yet in your directory, you can use the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.9.1 or later. This cmdlet takes as parameters
179+
If you wish to add an assignment for a user who is not yet in your directory, you can use the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x. This cmdlet takes as parameters
180180
* the access package ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackage` cmdlet,
181181
* the access package assignment policy ID, which is included in the response from the `Get-MgEntitlementManagementAccessPackageAssignmentPolicy`cmdlet,
182182
* the email address of the target user.
@@ -246,7 +246,7 @@ You can also remove an assignment of a user to an access package using Microsoft
246246

247247
### Remove an assignment with PowerShell
248248

249-
You can remove a user's assignment in PowerShell with the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or later.
249+
You can remove a user's assignment in PowerShell with the `New-MgEntitlementManagementAccessPackageAssignmentRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
250250

251251
```powershell
252252
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"

articles/active-directory/governance/entitlement-management-access-package-auto-assignment-policy.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ This script below illustrates using the `v1.0` profile, to create a policy for a
8888

8989
```powershell
9090
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
91-
Select-MgProfile -Name "v1.0"
9291
9392
$apid = "cdd5f06b-752a-4c9f-97a6-82f4eda6c76d"
9493

articles/active-directory/governance/entitlement-management-access-package-create.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ You can create an access package by using Microsoft Graph. A user in an appropri
153153

154154
### Create an access package by using Microsoft PowerShell
155155

156-
You can also create an access package in PowerShell by using the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or later. This script illustrates using the Microsoft Graph `beta` profile.
156+
You can also create an access package in PowerShell by using the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
157157

158158
First, retrieve the ID of the catalog (and of the resources and their roles in that catalog) that you want to include in the access package. Use a script similar to the following example:
159159

articles/active-directory/governance/entitlement-management-access-package-incompatible.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@ This script below illustrates using the `v1.0` profile of Graph to create a rela
8181

8282
```powershell
8383
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
84-
Select-MgProfile -Name "v1.0"
8584
8685
$apid = "5925c3f7-ed14-4157-99d9-64353604697a"
8786
$otherapid = "cdd5f06b-752a-4c9f-97a6-82f4eda6c76d"
@@ -172,19 +171,19 @@ You can retrieve assignments to an access package using Microsoft Graph, that ar
172171

173172
### Identifying users who already have incompatible access using PowerShell
174173

175-
You can also query the users who have assignments to an access package with the `Get-MgEntitlementManagementAccessPackageAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or later.
174+
You can also query the users who have assignments to an access package with the `Get-MgEntitlementManagementAssignment` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.1.0 or later.
176175

177176
For example, if you have two access packages, one with ID `29be137f-b006-426c-b46a-0df3d4e25ccd` and the other with ID `cce10272-68d8-4482-8ba3-a5965c86cfe5`, then you could retrieve the users who have assignments to the first access package, and then compare them to the users who have assignments to the second access package. You can also report the users who have assignments delivered to both, using a PowerShell script similar to the following:
178177

179178
```powershell
180179
$c = Connect-MgGraph -Scopes "EntitlementManagement.Read.All"
181-
Select-MgProfile -Name "beta"
180+
182181
$ap_w_id = "29be137f-b006-426c-b46a-0df3d4e25ccd"
183182
$ap_e_id = "cce10272-68d8-4482-8ba3-a5965c86cfe5"
184-
$apa_w_filter = "accessPackage/id eq '" + $ap_w_id + "' and assignmentState eq 'Delivered'"
185-
$apa_e_filter = "accessPackage/id eq '" + $ap_e_id + "' and assignmentState eq 'Delivered'"
186-
$apa_w = Get-MgEntitlementManagementAccessPackageAssignment -Filter $apa_w_filter -ExpandProperty target -All
187-
$apa_e = Get-MgEntitlementManagementAccessPackageAssignment -Filter $apa_e_filter -ExpandProperty target -All
183+
$apa_w_filter = "accessPackage/id eq '" + $ap_w_id + "' and state eq 'Delivered'"
184+
$apa_e_filter = "accessPackage/id eq '" + $ap_e_id + "' and state eq 'Delivered'"
185+
$apa_w = Get-MgEntitlementManagementAssignment -Filter $apa_w_filter -ExpandProperty target -All
186+
$apa_e = Get-MgEntitlementManagementAssignment -Filter $apa_e_filter -ExpandProperty target -All
188187
$htt = @{}; foreach ($e in $apa_e) { if ($null -ne $e.Target -and $null -ne $e.Target.Id) {$htt[$e.Target.Id] = $e} }
189188
foreach ($w in $apa_w) { if ($null -ne $w.Target -and $null -ne $w.Target.Id -and $htt.ContainsKey($w.Target.Id)) { write-output $w.Target.Email } }
190189
```

articles/active-directory/governance/entitlement-management-access-package-request-policy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ You can create a policy using Microsoft Graph. A user in an appropriate role wit
219219

220220
### Create an access package assignment policy through PowerShell
221221

222-
You can also create an access package in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or later.
222+
You can also create an access package in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
223223

224224
This script below illustrates using the `beta` profile, to create a policy for direct assignment to an access package. In this policy, only the administrator can assign access, and there are no access reviews. See [Create an automatic assignment policy](entitlement-management-access-package-auto-assignment-policy.md#create-an-access-package-assignment-policy-through-powershell) for an example of how to create an automatic assignment policy, and [create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-beta&preserve-view=true) for more examples.
225225

articles/active-directory/governance/entitlement-management-access-package-resources.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ You can add a resource role to an access package using Microsoft Graph. A user i
185185

186186
### Add resource roles to an access package with Microsoft PowerShell
187187

188-
You can also create an access package in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or later. This script illustrates using the Graph `beta` profile.
188+
You can also create an access package in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. This script illustrates using the Graph `beta` profile and Microsoft Graph PowerShell cmdlets module version 1.x.x.
189189

190190
First, you would retrieve the ID of the catalog, and of the resources and their roles in that catalog that you wish to include in the access package, using a script similar to the following.
191191

articles/active-directory/governance/entitlement-management-catalog-create.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,11 @@ You can create a catalog by using Microsoft Graph. A user in an appropriate role
6565

6666
### Create a catalog with PowerShell
6767

68-
You can also create a catalog in PowerShell with the `New-MgEntitlementManagementAccessPackageCatalog` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or later.
68+
You can also create a catalog in PowerShell with the `New-MgEntitlementManagementCatalog` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 2.2.0 or later.
6969

7070
```powershell
7171
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
72-
Select-MgProfile -Name "beta"
73-
$catalog = New-MgEntitlementManagementAccessPackageCatalog -DisplayName "Marketing"
72+
$catalog = New-MgEntitlementManagementCatalog -DisplayName "Marketing"
7473
```
7574

7675
## Add resources to a catalog
@@ -180,7 +179,7 @@ You can also add a resource to a catalog by using Microsoft Graph. A user in an
180179

181180
### Add a resource to a catalog with PowerShell
182181

183-
You can also add a resource to a catalog in PowerShell with the `New-MgEntitlementManagementAccessPackageResourceRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or later. The following example shows how to add a group to a catalog as a resource.
182+
You can also add a resource to a catalog in PowerShell with the `New-MgEntitlementManagementAccessPackageResourceRequest` cmdlet from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.6.0 or a later 1.x.x module version, or Microsoft Graph PowerShell cmdlets beta module version 2.1.x or later beta module version. The following example shows how to add a group to a catalog as a resource using Microsoft Graph beta and Microsoft Graph PowerShell cmdlets module version 1.x.x.
184183

185184
```powershell
186185
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All,Group.ReadWrite.All"

articles/active-directory/governance/entitlement-management-organization.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,6 @@ This script below illustrates using the `v1.0` profile of Graph to retrieve all
161161

162162
```powershell
163163
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
164-
Select-MgProfile -Name "v1.0"
165164
166165
$co = Get-MgEntitlementManagementConnectedOrganization -all
167166

articles/active-directory/governance/identity-governance-automation.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,6 @@ $ClientId = Get-AutomationVariable -Name 'ClientId'
170170
$TenantId = Get-AutomationVariable -Name 'TenantId'
171171
$Thumbprint = Get-AutomationVariable -Name 'Thumbprint'
172172
$auth = Connect-MgGraph -clientId $ClientId -tenantid $TenantId -certificatethumbprint $Thumbprint
173-
Select-MgProfile -Name beta
174173
Import-Module Microsoft.Graph.Identity.Governance
175174
$ap = Get-MgEntitlementManagementAccessPackage -All -ErrorAction Stop
176175
$ap | Select-Object -Property Id,DisplayName | ConvertTo-Json

0 commit comments

Comments
 (0)