Forum Discussion
Expected exactly one role management policy assignment but 0 were found
I am getting the following error in Entra when I try to assign a custom role to a user:
Expected exactly one role management policy assignment but 0 were found
What I have done:
entra.microsoft.com → Entra ID: Roles & admins → New custom role
Basics
* Role name: User Directory Reader
* Description: Provides read-only access to user directory information. Intended for security analysts and auditors who require visibility into user identities without modification permissions.
Permissions
* microsoft.directory/users/standard/read
*microsoft.directory/users/memberOf/read
*microsoft.directory/users/manager/read
When I click + Add assignment I get the error "Expected exactly one role management policy assignment but 0 were found".
I have trial license for Privileged Identity Management (Entra ID P2).
2 Replies
Title: Experiencing the same PIM policy error with a custom LAPS role
Hi everyone,
I am running into this exact same backend sync issue in our tenant and wanted to share our scenario in case it helps pinpoint the trigger.
Our Scenario:
- Goal: We are deploying Windows LAPS and created a custom Entra ID role (named "LAPS Password Viewer") specifically so our local IT can view LAPS passwords.
- Permission: The role contains only one permission: microsoft.directory/deviceLocalCredentials/password/read
- Environment: M365 E5 tenant (PIM is active).
- The Issue: When trying to assign this new custom role to a test user, we immediately hit the "Expected exactly one role management policy assignment but 0 were found" error.
- Troubleshooting: We tried assigning the role directly through Identity > Roles & admins to bypass the main PIM interface, but the PIM engine still intercepts it and throws the exact same policy error. We also tried forcing a backend sync, but the hidden PIM policy for this custom role refuses to generate.
Has anyone found a reliable way to force PIM to generate the missing policy for newly created custom roles, or does this strictly require a Microsoft Support ticket to fix on the backend?
Yeah, give it some time. PIM uses its own directory store and some changes are not immediately synchronized. We've raised few similar issues with Microsoft, but they seem to be addressing them on a case-by-case basis, instead overhauling the implementation itself...
