Skip to content

New-MgIdentityGovernanceAccessReviewDefinitionInstance is not functional #2440

Open
@insomniacc

Description

@insomniacc

Describe the bug
I have a requirement to create access reviews, occasionally out of schedule.
I would like these instances to be part of the same definition so that all the audit data is kept under the same access review.

I'm attempting to use either the Update-MgIdentityGovernanceAccessReviewDefinition (also see issue microsoftgraph/msgraph-metadata#501)
or New-MgIdentityGovernanceAccessReviewDefinitionInstance command, but having no luck.

It appears that updating a definition will only update the end date and not the start date, of my reoccurring quarterly schedule, even after the current instance has ended. This is also the case if I use a one time schedule.
New-MgIdentityGovernanceAccessReviewDefinitionInstance also does not appear to be functional and throws errors also and when looking at the endpoints in the API documentation here: https://learn.microsoft.com/en-us/graph/api/resources/accessreviewinstance?view=graph-rest-1.0
I see no reference to any POST/Create activity for the instance endpoint.

New-MgIdentityGovernanceAccessReviewDefinitionInstance : {"Message":"No HTTP resource was found that matches the request URI 'https://api.accessreviews.identitygovernance.azure.com/accessReviews/v2.0/definitions('<accessReviewID>')/instances?ring=2'."}
Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2023-11-14T21:33:12
Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : <RequestID>
client-request-id             : <ClientRequestID>
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"005","RoleInstance":"<RoleInstance>"}}
Date                          : Tue, 14 Nov 2023 21:33:12 GMT
At line:1 char:1
+ New-MgIdentityGovernanceAccessReviewDefinitionInstance -AccessReviewS ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ AccessReviewS...eviewInstance }:<>f__AnonymousType299`2) [New-MgIdentityG...Instance_Create], Exception
    + FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.NewMgIdentityGovernanceAccessReviewDefinitionInstance_Create

To Reproduce

$params = @{
    displayName = "AccessReview Test"
    descriptionForAdmins = "Test"
    descriptionForReviewers = "Test"
    scope = @{
        "@odata.type" = "#microsoft.graph.accessReviewQueryScope"
        query = "/groups/<GroupID>/transitiveMembers"
        queryType = "MicrosoftGraph"
    }
    reviewers = @(
        @{
            query = "/users/<UserID>"
            queryType = "MicrosoftGraph"
        }
    )
    settings = @{
        mailNotificationsEnabled = $false
        reminderNotificationsEnabled = $false
        justificationRequiredOnApproval = $false
        defaultDecisionEnabled = $true
        defaultDecision = "Deny"
        autoApplyDecisionsEnabled = $false
        instanceDurationInDays = 2
        recommendationsEnabled = $false
        recurrence = @{
            range = @{
                type = "endDate"
                startDate = (get-date).AddDays(3).tostring('yyyy-MM-dd')
                endDate = (get-date).AddDays(5).tostring('yyyy-MM-dd')
            }
        }
    }
}
New-MgIdentityGovernanceAccessReviewDefinitionInstance -AccessReviewScheduleDefinitionId "<AccessReviewID>" -BodyParameter $params

Expected behavior
To be able to either update an existing definition schedule, or instance schedule, or to create a new instance with customised schedule

Module Version
2.9.0

Environment Data
PSVersion 7.2.16

Additional context
I think this module needs a full review & testing properly as there seems to be lots of issues with the identity governance module.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions