Addin Eligible role to Subscription by powershell
Question

Question

I need assign groups to roles for subscription by powershell (100+ groups and subsc)I need this was eligible so users in grop must use PIN to activate role.How to do this?&nbsp;

adeelaziz · Answer

My apologies for the oversight.&nbsp; This is the updated script, I've tested it in my lab.&nbsp; Please update the parameters as needed.# Import the CSV file
$groups = Import-Csv -Path "path	o\your\groups.csv"

# Connect to Azure
Connect-AzAccount

# Define the role
$roleDefinitionId = (Get-AzRoleDefinition -Name "Contributor").Id

# Loop through each group and assign the role
foreach ($group in $groups) {
    try {
        $groupName = $group.GroupName
        $resourceGroup = $group.ResourceGroup
        $scope = "/subscriptions/your-subscription-id/resourceGroups/$resourceGroup"

$groupObject = Get-AzADGroup -DisplayName $groupName
        $groupId = $groupObject.Id

# Define the GUID for the request
        $guid = [guid]::NewGuid().Guid

# Define the start time in ISO 8601 format
        $startTime = Get-Date -Format o

# Assign the role with eligible and time-bound settings
        New-AzRoleEligibilityScheduleRequest -Name $guid -Scope $scope -ExpirationDuration "PT8H" -ExpirationType AfterDuration -PrincipalId $groupId -RequestType AdminAssign -RoleDefinitionId $roleDefinitionId -ScheduleInfoStartDateTime $startTime

Write-Output "Successfully assigned role to group: $groupName for resource group: $resourceGroup"
    }
    catch {
        Write-Error "Failed to assign role to group: $groupName for resource group: $resourceGroup. Error: $_"
    }
}

Write-Output "Role assignments completed."&nbsp;

adeelaziz · Answer

This should be doable.&nbsp; Assuming you are assigning the permissions to Resource Groups you ideally want to specify the group names, and the Resource Group names in a CSV file.&nbsp; Something like the following, remember to keep the column header as they will be referenced in the powershell script.CSV File with Groups and Resource GroupsGroupName,ResourceGroupGroup1,ResourceGroup1Group2,ResourceGroup2Group3,ResourceGroup3etcIn the script below the duration is specified using the ISO 8601 format.&nbsp; PT8H means 8 hours, you can use P1D for 1 day or P3M to denote 3 months, P1Y for 1 year and so on.The script will loop through all the rows in your CSV file and try the role assignment.&nbsp;Script:# Import the CSV file$groups = Import-Csv -Path "path	o\your\groups.csv"# Connect to AzureConnect-AzAccount# Define the role$roleDefinitionId = (Get-AzRoleDefinition -Name "Contributor").Id# Loop through each group and assign the roleforeach ($group in $groups) {&nbsp; &nbsp; try {&nbsp; &nbsp; &nbsp; &nbsp; $groupName = $group.GroupName&nbsp; &nbsp; &nbsp; &nbsp; $resourceGroup = $group.ResourceGroup&nbsp; &nbsp; &nbsp; &nbsp; $scope = "/subscriptions/your-subscription-id/resourceGroups/$resourceGroup"&nbsp; &nbsp; &nbsp; &nbsp; $groupObject = Get-AzADGroup -DisplayName $groupName&nbsp; &nbsp; &nbsp; &nbsp; $groupId = $groupObject.Id&nbsp; &nbsp; &nbsp; &nbsp; # Assign the role with eligible and time-bound settings&nbsp; &nbsp; &nbsp; &nbsp; New-AzRoleAssignment -ObjectId $groupId -RoleDefinitionId $roleDefinitionId -Scope $scope -AssignmentType "Eligible" -Duration "PT8H"&nbsp; &nbsp; &nbsp; &nbsp; Write-Output "Successfully assigned role to group: $groupName for resource group: $resourceGroup"&nbsp; &nbsp; }&nbsp; &nbsp; catch {&nbsp; &nbsp; &nbsp; &nbsp; Write-Error "Failed to assign role to group: $groupName for resource group: $resourceGroup. Error: $_"&nbsp; &nbsp; }}Write-Output "Role assignments completed."

adeelaziz · Answer

I responded to this earlier today but noticed my reply is stick. Here goes attempt #2.

You can do this by reading in a list of Group names and Resource Groups from a csv file. The CSV file should be formatted like the example below and please keep the column headers as they will be referenced in the script.

CSV input file for script:
GroupName,ResourceGroup
Group1,ResourceGroup1
Group2,ResourceGroup2
Group3,ResourceGroup3

Note:

The duration is set by -Duration flag in the New-AzRoleAssignment cmdlet. I've set it to be "P1Y" which denotes 1 year. You could change that to "P1M" for 1 month etc. This is the ISO 8601 standard for setting durations.

Script:

# Import the CSV file
$groups = Import-Csv -Path "path\to\your\groups.csv"

# Connect to Azure
Connect-AzAccount

# Define the role
$roleDefinitionId = (Get-AzRoleDefinition -Name "Contributor").Id

# Loop through each group and assign the role
foreach ($group in $groups) {
try {
$groupName = $group.GroupName
$resourceGroup = $group.ResourceGroup
$scope = "/subscriptions/your-subscription-id/resourceGroups/$resourceGroup"

$groupObject = Get-AzADGroup -DisplayName $groupName
$groupId = $groupObject.Id

# Assign the role with eligible and time-bound settings for 1 year
New-AzRoleAssignment -ObjectId $groupId -RoleDefinitionId $roleDefinitionId -Scope $scope -AssignmentType "Eligible" -Duration "P1Y"

Write-Output "Successfully assigned role to group: $groupName for resource group: $resourceGroup"
}
catch {
Write-Error "Failed to assign role to group: $groupName for resource group: $resourceGroup. Error: $_"
}
}

Write-Output "Role assignments completed."

adeelaziz · Answer

I responded to this earlier today but noticed my reply is stick.&nbsp; Here goes attempt #2.&nbsp;You can do this by reading in a list of Group names and Resource Groups from a csv file.&nbsp; The CSV file should be formatted like the example below and please keep the column headers as they will be referenced in the script.&nbsp;CSV input file for script:GroupName,ResourceGroupGroup1,ResourceGroup1Group2,ResourceGroup2Group3,ResourceGroup3&nbsp;Note:The duration is set by -Duration flag in the New-AzRoleAssignment cmdlet.&nbsp; I've set it to be "P1Y" which denotes 1 year.&nbsp; You could change that to "P1M" for 1 month etc.&nbsp; This is the ISO 8601 standard for setting durations.&nbsp;Script:# Import the CSV file
$groups = Import-Csv -Path "path	o\your\groups.csv"

# Connect to Azure
Connect-AzAccount

# Define the role
$roleDefinitionId = (Get-AzRoleDefinition -Name "Contributor").Id

# Loop through each group and assign the role
foreach ($group in $groups) {
    try {
        $groupName = $group.GroupName
        $resourceGroup = $group.ResourceGroup
        $scope = "/subscriptions/your-subscription-id/resourceGroups/$resourceGroup"

$groupObject = Get-AzADGroup -DisplayName $groupName
        $groupId = $groupObject.Id

# Assign the role with eligible and time-bound settings for 1 year
        New-AzRoleAssignment -ObjectId $groupId -RoleDefinitionId $roleDefinitionId -Scope $scope -AssignmentType "Eligible" -Duration "P1Y"

Write-Output "Successfully assigned role to group: $groupName for resource group: $resourceGroup"
    }
    catch {
        Write-Error "Failed to assign role to group: $groupName for resource group: $resourceGroup. Error: $_"
    }
}

Write-Output "Role assignments completed."&nbsp;

adeelaziz · Answer

You can do this by reading in a list of Group names and Resource Groups from a csv file.&nbsp; The CSV file should be formatted like the example below and please keep the column headers as they will be referenced in the script.&nbsp;CSV input file for script:GroupName,ResourceGroupGroup1,ResourceGroup1Group2,ResourceGroup2Group3,ResourceGroup3&nbsp;Note:The duration is set by -Duration flag in the New-AzRoleAssignment cmdlet.&nbsp; I've set it to be "P1Y" which denotes 1 year.&nbsp; You could change that to "P1M" for 1 month etc.&nbsp; This is the ISO 8601 standard for setting durations.&nbsp;Script:# Import the CSV file
$groups = Import-Csv -Path "path	o\your\groups.csv"

# Connect to Azure
Connect-AzAccount

# Define the role
$roleDefinitionId = (Get-AzRoleDefinition -Name "Contributor").Id

# Loop through each group and assign the role
foreach ($group in $groups) {
    try {
        $groupName = $group.GroupName
        $resourceGroup = $group.ResourceGroup
        $scope = "/subscriptions/your-subscription-id/resourceGroups/$resourceGroup"

$groupObject = Get-AzADGroup -DisplayName $groupName
        $groupId = $groupObject.Id

# Assign the role with eligible and time-bound settings for 1 year
        New-AzRoleAssignment -ObjectId $groupId -RoleDefinitionId $roleDefinitionId -Scope $scope -AssignmentType "Eligible" -Duration "P1Y"

Write-Output "Successfully assigned role to group: $groupName for resource group: $resourceGroup"
    }
    catch {
        Write-Error "Failed to assign role to group: $groupName for resource group: $resourceGroup. Error: $_"
    }
}

Write-Output "Role assignments completed."&nbsp;

Forum Discussion

Addin Eligible role to Subscription by powershell Question

9 Replies

Resources