Fetching All Directory Roles Assigned to Users Using PowerShell

Hello VJ!

Welcome to Microsoft QnA! Hope you are doing well! 😊

To fetch all directory roles assigned to a user in Azure AD, including whether the roles are eligible or active, you can use the Azure AD PowerShell module or the Microsoft Graph API. It sounds like you're encountering a limitation with the current command, which may not be returning all roles due to pagination or query restrictions.

Here’s a PowerShell script using the AzureAD module to fetch all the directory roles assigned to a user:

Install-Modu
$userId = "<UserObjectID>"
$roles = Get-AzureADUserAppRoleAssignment -ObjectId $userId

# Fetch details of the roles
$roles | ForEach-Object {
    $role = Get-AzureADDirectoryRole | Where-Object { $_.ObjectId -eq $_.DirectoryRoleId }
    $role
}

This script will retrieve all roles assigned to the specified user and display them. However, if you're still not getting all the roles, make sure to check if there is any paging or limitation in the API response.

If you're using the Microsoft Graph API, you can use this endpoint to get role assignments:

GET https://graph.microsoft.com/v1.0/users/{userId}/appRoleAssignments

To make sure you're getting all the roles, ensure you handle pagination if the response is too large.

Let me know if this works for you or if you need further assistance! 😊

✨ Please Upvote and Accept the Answer if it helps! ✨

Thanks & Regards,

Tasadduq Burney

(Microsoft MVP & MCT)

(Azure 15x)

Hi @VJ

Thank you for posting this in Microsoft Q&A.

I understand that you want to fetch all active and eligible directory roles for a user using PowerShell.

Use the following commands to get active and eligible role assignments in Microsoft Entra ID:

Install-Module Microsoft.Graph.Identity.Governance

Import-Module Microsoft.Graph.Identity.Governance

Connect-MgGraph -Scopes RoleManagement.Read.Directory, Directory.Read.All

Use Get-MgRoleManagementDirectoryRoleEligibilitySchedule to get eligible roles and Get-MgRoleManagementDirectoryRoleAssignmentSchedule to retrieve active roles.

If you are facing the same issue with the above commands, please share your script so I can look into it.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

There is no single cmdlet that can give you all that. The closest you can get is to leverage the Get-MgBetaRoleManagementDirectoryTransitiveRoleAssignment cmdlet, which can be used to list all active directory role assignments, including those scoped to administrative units and those where the role is indirectly assigned to the user via group membership.

Get-MgBetaRoleManagementDirectoryTransitiveRoleAssignment -Filter "principalId eq 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'"  -ConsistencyLevel eventual

Do note that you need to use /beta here, and also the consistencyLevel:eventual header.

To also include PIM eligible roles, you need the Get-MgBetaRoleManagementDirectoryRoleEligibilitySchedule cmdlet:

Get-MgBetaRoleManagementDirectoryRoleEligibilitySchedule -Filter "principalId eq 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'"