maester icon indicating copy to clipboard operation
maester copied to clipboard

Keeping Entra roles current in Get-MtRoleMember

Open SamErde opened this issue 3 months ago • 0 comments

The list of Entra privileged roles changes over time, which makes the [ValidateSet()] statement in Get-MtRoleMember enforce an incomplete list of values.

See: https://github.com/maester365/maester/blob/d67de01cd7286e4207a9fa6fdcef5b646517247c/powershell/public/Get-MtRoleMember.ps1#L46

We should update this list dynamically by either:

  • Caching the list in a dictionary when Invoke-Maester is run and using that from any tests that reference the list of roles.
  • Using a GitHub workflow to automatically check for new or modified roles and automatically create a PR with the changed list.

Either might rely on a basic list that is queried as $Roles = Get-MgRoleManagementDirectoryRoleDefinition.

or something like:

$RoleMap = Get-MgRoleManagementDirectoryRoleDefinition |
    ForEach-Object { @{ $_.DisplayName = $_.Id } }

# Example lookup
$RoleMap["Global Administrator"]

SamErde avatar Sep 10 '25 21:09 SamErde