Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New-MgIdentityGovernanceAccessReviewDefinitionInstance is not functional #2440

Open
insomniacc opened this issue Nov 14, 2023 · 0 comments
Open

Comments

@insomniacc
Copy link

Describe the bug
I have a requirement to create access reviews, occasionally out of schedule.
I would like these instances to be part of the same definition so that all the audit data is kept under the same access review.

I'm attempting to use either the Update-MgIdentityGovernanceAccessReviewDefinition (also see issue microsoftgraph/msgraph-metadata#501)
or New-MgIdentityGovernanceAccessReviewDefinitionInstance command, but having no luck.

It appears that updating a definition will only update the end date and not the start date, of my reoccurring quarterly schedule, even after the current instance has ended. This is also the case if I use a one time schedule.
New-MgIdentityGovernanceAccessReviewDefinitionInstance also does not appear to be functional and throws errors also and when looking at the endpoints in the API documentation here: https://learn.microsoft.com/en-us/graph/api/resources/accessreviewinstance?view=graph-rest-1.0
I see no reference to any POST/Create activity for the instance endpoint.

New-MgIdentityGovernanceAccessReviewDefinitionInstance : {"Message":"No HTTP resource was found that matches the request URI 'https://api.accessreviews.identitygovernance.azure.com/accessReviews/v2.0/definitions('<accessReviewID>')/instances?ring=2'."}
Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2023-11-14T21:33:12
Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : <RequestID>
client-request-id             : <ClientRequestID>
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"005","RoleInstance":"<RoleInstance>"}}
Date                          : Tue, 14 Nov 2023 21:33:12 GMT
At line:1 char:1
+ New-MgIdentityGovernanceAccessReviewDefinitionInstance -AccessReviewS ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ AccessReviewS...eviewInstance }:<>f__AnonymousType299`2) [New-MgIdentityG...Instance_Create], Exception
    + FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.NewMgIdentityGovernanceAccessReviewDefinitionInstance_Create

To Reproduce

$params = @{
    displayName = "AccessReview Test"
    descriptionForAdmins = "Test"
    descriptionForReviewers = "Test"
    scope = @{
        "@odata.type" = "#microsoft.graph.accessReviewQueryScope"
        query = "/groups/<GroupID>/transitiveMembers"
        queryType = "MicrosoftGraph"
    }
    reviewers = @(
        @{
            query = "/users/<UserID>"
            queryType = "MicrosoftGraph"
        }
    )
    settings = @{
        mailNotificationsEnabled = $false
        reminderNotificationsEnabled = $false
        justificationRequiredOnApproval = $false
        defaultDecisionEnabled = $true
        defaultDecision = "Deny"
        autoApplyDecisionsEnabled = $false
        instanceDurationInDays = 2
        recommendationsEnabled = $false
        recurrence = @{
            range = @{
                type = "endDate"
                startDate = (get-date).AddDays(3).tostring('yyyy-MM-dd')
                endDate = (get-date).AddDays(5).tostring('yyyy-MM-dd')
            }
        }
    }
}
New-MgIdentityGovernanceAccessReviewDefinitionInstance -AccessReviewScheduleDefinitionId "<AccessReviewID>" -BodyParameter $params

Expected behavior
To be able to either update an existing definition schedule, or instance schedule, or to create a new instance with customised schedule

Module Version
2.9.0

Environment Data
PSVersion 7.2.16

Additional context
I think this module needs a full review & testing properly as there seems to be lots of issues with the identity governance module.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants