search

AlexFilipin / ConditionalAccess

MIT License
274 stars 72 forks source link

New-MgBetaGroup Insufficient privileges to complete the operation becouse of Parameter IsAssignableToRole:$true #43

Closed Mike2607 closed 2 months ago

Mike2607 commented 3 months ago

In the updated version of the script, creating groups no longer works. The error message shown below appears with the command “New-MgBetaGroup -DisplayName $Name -SecurityEnabled:$true -MailEnabled:$false -MailNickname “NotSet” -Visibility Private -IsAssignableToRole:$true”. If we leave out the IsAssignableToRole:$true parameter, creating the group works.

Is there any information here about which permissions are missing here?

Screenshot 2024-08-14 141505 `New-MgBetaGroup : Insufficient privileges to complete the operation. Status: 403 (Forbidden) ErrorCode: Authorization_RequestDenied Date: 2024-08-14T11:08:19 Headers: Transfer-Encoding : chunked Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : d0d2b3e0-a9b8-45c0-ada0-ed4f1ba5a466 client-request-id : d04be0ac-db69-4049-a5f7-56849a66da99 x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"FR2PEPF000003B8"}} Link : < https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview: cloudLicensing&from=2024-04-01&to=2024-05-01>;rel="deprecation";type="text/html",< https://developer.microsoft-tst.com/e n-us/graph/changes?$filterby=beta,PrivatePreview:cloudLicensing&from=2024-04-01&to=2024-05-01>;rel="deprecation";type=" text/html" Deprecation : Fri, 19 Apr 2024 23:59:59 GMT Sunset : Sun, 19 Apr 2026 23:59:59 GMT x-ms-resource-unit : 1 Cache-Control : no-cache Date : Wed, 14 Aug 2024 11:08:19 GMT In Zeile:1 Zeichen:1 New-MgBetaGroup -DisplayName CA_TMP -SecurityEnabled:$true -MailEnabl ...

CategoryInfo : InvalidOperation: ({ Headers = , b...oftGraphGroup }:<>f__AnonymousType22) [New-MgBetaG roup_CreateExpanded], Exception FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Graph.Beta.PowerShell.Cmdlets.NewMgBetaGroup_Creat eExpanded

bytewerk-lab commented 2 months ago

We have the same Problem

AlexFilipin commented 2 months ago

@Timsto can you take a look at this given you have taken over maintaining the repo? There are few other issues too.

For this one , using role assignable groups was a workaround because nothing better was available a couple years ago. If I had to do this today I would create regular groups (not role assignable) and then add them to a restricted management admin unit to protect them

Timsto commented 2 months ago

will pulish a update over the weekend

Timsto commented 2 months ago

@Mike2607 do you run the script as a Service Principal or as an User? Additional i added a site with the required Permission.

New Update will be published this evening!

Timsto commented 2 months ago

declared the permission in the wiki. add new version where a mix of IsAssignableToRole True and False exist + Add a protection layer with a restricted management AU