Entra Roles Inventory

[merill]

Originally sourced from https://github.com/michevnew/PowerShell/blob/master/AADRolesInventory-Graph.ps1

• Added updates to show flag for privileged roles
• Added lookup of users within groups

#Requires -Version 3.0
[CmdletBinding(SupportsShouldProcess)] #Make sure we can use -WhatIf and -Verbose
Param([switch]$IncludePIMEligibleAssignments) #Indicate whether to include PIM elibigle role assignments in the output. NOTE: Currently the RoleManagement.Read.Directory scope seems to be required!

#For details on what the script does and how to run it, check: https://www.michev.info/blog/post/3958/generate-a-report-of-azure-ad-role-assignments-via-the-graph-api-or-powershell

#region Authentication
# try { Connect-MgGraph -Scopes RoleManagement.Read.Directory,Directory.Read.All} #RoleManagement.Read.Directory needed for PIM eligible assignments, Directory.Read.All for roles and "translating" GUIDs
# catch { Write-Error $_ -ErrorAction Stop; return }
#endregion Authentication

# if (!(Get-MgContext).Scopes.Contains("Directory.Read.All")) { Write-Error "The required permissions are missing, please re-consent!" -ErrorAction Stop }
$privilegedRoles = Get-MgBetaRoleManagementDirectoryRoleDefinition -Filter "isPrivileged eq true"
#region Roles
Write-Verbose "Collecting role assignments..."

#Use the Get-MgRoleManagementDirectoryRoleAssignment cmdlet to collect a list of all role assignments.
$roles = Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty Principal #$expand=* is BROKEN
$roles1 = Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty roleDefinition #fix to also fetch the roleDefinition
foreach ($role in $roles) { Add-Member -InputObject $role -MemberType NoteProperty -Name roleDefinition1 -Value ($roles1 | ? {$_.id -eq $role.id}).roleDefinition } #and another fix needed as PowerShell populates empty roleDefinition property...

#Use the Get-MgRoleManagementDirectoryRoleEligibilitySchedule cmdlet to collect a list of all PIM eligible role assignments.
if ($IncludePIMEligibleAssignments) {
    Write-Verbose "Collecting PIM eligible role assignments..."

    $roles += (Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All -ExpandProperty * | select id,principalId,directoryScopeId,roleDefinitionId,status,principal,@{n="roleDefinition1";e={$_.roleDefinition}})
}

if (!$roles) { Write-Verbose "No valid role assignments found, verify the required permissions have been granted?"}

Write-Verbose "A total of $($roles.count) role assignments were found, of which $(($roles | ? {$_.directoryScopeId -eq "/"}).Count) are tenant-wide and $(($roles | ? {$_.directoryScopeId -ne "/"}).Count) are AU-scoped. $(($roles | ? {!$_.status}).Count) roles are permanently assigned, you might want to address that!"
#endregion Roles

#region Output
#prepare the script output
Write-Verbose "Preparing the output..."
$report = @()
foreach ($role in $roles) {
    $reportLine=[ordered]@{
        "Id" = $role.principal.Id
        "Principal" = switch ($role.principal.AdditionalProperties.'@odata.type') {
            '#microsoft.graph.user' {$role.principal.AdditionalProperties.userPrincipalName}
            '#microsoft.graph.servicePrincipal' {$role.principal.AdditionalProperties.appId}
            '#microsoft.graph.group' {$role.principalid}
        }
        "PrincipalDisplayName" = $role.principal.AdditionalProperties.displayName
        "PrincipalType" = $role.principal.AdditionalProperties.'@odata.type'.Split(".")[-1]
        "AssignedRole" = $role.roleDefinition1.displayName
        "AssignedRoleScope" = $role.directoryScopeId
        "AssignmentType" = (&{if ($role.status -eq "Provisioned") {"Eligible"} else {"Permanent"}})
        "IsPrivileged" = $role.roleDefinition1.templateId -in $privilegedRoles.id
        "IsBuiltIn" = $role.roleDefinition1.isBuiltIn
        "RoleTemplate" = $role.roleDefinition1.templateId
    }
    $report += @([pscustomobject]$reportLine)
    if($reportLine.PrincipalType -eq "group") {
        $allUsers = Get-MgGroupTransitiveMember -GroupId $Role.PrincipalId
        foreach($user in $allUsers){
            $reportLineUser=[ordered]@{
                "Id" = $user.Id
                "Principal" = switch ($user.AdditionalProperties.'@odata.type') {
                    '#microsoft.graph.user' {$user.AdditionalProperties.userPrincipalName}
                    '#microsoft.graph.servicePrincipal' {$user.AdditionalProperties.appId}
                    '#microsoft.graph.group' {$user.principalid}
                }
                "PrincipalDisplayName" = $user.AdditionalProperties.displayName
                "PrincipalType" = $user.AdditionalProperties.'@odata.type'.Split(".")[-1]
                "AssignedRole" = $role.roleDefinition1.displayName
                "AssignedRoleScope" = $role.directoryScopeId
                "AssignmentType" = (&{if ($role.status -eq "Provisioned") {"Eligible"} else {"Permanent"}})
                "IsBuiltIn" = $role.roleDefinition1.isBuiltIn
                "IsPrivileged" = $role.roleDefinition1.templateId -in $privilegedRoles.id
                "RoleTemplate" = $role.roleDefinition1.templateId
            }
            $report += @([pscustomobject]$reportLineUser)
        }
    }
}
#endregion Output

#format and export
$report | Export-CSV -nti -Path "$((Get-Date).ToString('yyyy-MM-dd_HH-mm-ss'))_AzureADRoleInventory.csv"

[ei-zascha]

If you use the Beta command for grabbing the RoleDefinitions it will return additional properties, including the "isPrivileged" property:

$roles1 = Get-MgBetaRoleManagementDirectoryRoleAssignment -All -ExpandProperty roleDefinition

For example (ID's redacted):

(Get-MgBetaRoleManagementDirectoryRoleAssignment -ExpandProperty roleDefinition -All).Where({$_.RoleDefinition.IsPrivileged})[0].RoleDefinition | fl

AllowedPrincipalTypes   :
Description             :
DisplayName             : O365 Group Script limited role
Id                      : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
InheritsPermissionsFrom :
IsBuiltIn               : False
IsEnabled               : True
IsPrivileged            : True
ResourceScopes          : {/}
RolePermissions         : {Microsoft.Graph.Beta.PowerShell.Models.MicrosoftGraphUnifiedRolePermission}
TemplateId              : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Version                 :
AdditionalProperties    : {}

This avoids the extra call to Get-MgBetaRoleManagementDirectoryRoleDefinition and then you can build your $reportLine object as follows:

$reportLine=[ordered]@{
    "Id"        = $role.principal.Id
    "Principal" = switch ($role.principal.AdditionalProperties.'@odata.type') {
        '#microsoft.graph.user' {$role.principal.AdditionalProperties.userPrincipalName}
        '#microsoft.graph.servicePrincipal' {$role.principal.AdditionalProperties.appId}
        '#microsoft.graph.group' {$role.principalid}
    }
    "PrincipalDisplayName" = $role.principal.AdditionalProperties.displayName
    "PrincipalType"        = $role.principal.AdditionalProperties.'@odata.type'.Split(".")[-1]
    "AssignedRole"         = $role.roleDefinition1.displayName
    "AssignedRoleScope"    = $role.directoryScopeId
    "AssignmentType"       = (&{if ($role.status -eq "Provisioned") {"Eligible"} else {"Permanent"}})
    "IsPrivileged"         = $role.roleDefinition1.IsPrivileged
    "IsBuiltIn"            = $role.roleDefinition1.isBuiltIn
    "RoleTemplate"         = $role.roleDefinition1.templateId
}

Also, instead of adding a second roleDefinition NoteProperty with a different property name, you can just overwrite the existing one returned by the first call with the -Force parameter:

foreach ($role in $roles) {
    Add-Member -InputObject $role -MemberType NoteProperty -Name RoleDefinition -Value ($roles1 | ? {$_.Id -eq $role.Id}).RoleDefinition -Force
}

Instead of:

foreach ($role in $roles) {
    Add-Member -InputObject $role -MemberType NoteProperty -Name roleDefinition1 -Value ($roles1 | ? {$_.id -eq $role.id}).roleDefinition
}