New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance fails when Authentication Context is enabled on Group

[jeremyhagan]

Describe the bug

I am trying to submit a new group activation request using MgGraph. The group has the setting On activation, require: Authentication context: PIM Activation configured.

I have used Get-MsalToken to acquire an access token which includes the acrs claim c1 and if I decode the token using https://jwt.ms/ I can see the acrs = c1 in the token and the auth log show that the login trigger the CA policy with the auth context.

However, when I attempt to use New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance to elevate I get the error: RoleAssignmentRequestAcrsValidationFailed

Expected behavior

The cmdlet succeeds

How to reproduce

$graph = "https://graph.microsoft.com"
$scopes = @(
    "$graph/PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
    "$graph/PrivilegedEligibilitySchedule.Read.AzureADGroup",
    "$graph/RoleManagementPolicy.Read.AzureADGroup"
)
$tenantId = "TENANT_ID"
$appId = "14d82eec-204b-4c2f-b7e8-296a70dab67e"

$connectionDetails = @{
    'TenantId'              = $tenantId
    'ClientId'              = $appId
    'Interactive'           = $true
    'scopes'                = $scopes
    'ExtraQueryParameters'  = @{'claims' = '%7B%22access_token%22%3A%7B%22acrs%22%3A%7B%22essential%22%3Atrue%2C%22value%22%3A%22c1%22%7D%7D%7D'}
}
Clear-MsalTokenCache
$token = Get-MsalToken @connectionDetails
Connect-MgGraph -NoWelcome -AccessToken ($token.AccessToken | ConvertTo-SecureString -AsPlainText)
$myAccount = Get-MgUser -UserId (Get-MgContext).Account
$requestParams = @{
    accessId = "member"
    principalId = $myAccount.Id
    groupId = "GROUP_ID"
    action = "selfActivate"
    scheduleInfo = @{
        startDateTime = (Get-Date)
        expiration = @{
            type = "afterDuration"
            duration = "PT1H"
        }
    }
}
New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest -BodyParameter $requestParams

SDK Version

2.19.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

```

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method: POST

Absolute Uri: https://graph.microsoft.com/v1.0/identityGovernance/privilegedAccess/group/assignmentScheduleRequests

Headers: FeatureFlag : 00000043 Cache-Control : no-store, no-cache User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763; en-AU),PowerShell/2024.2.2 Accept-Encoding : gzip SdkVersion : graph-powershell/2.19.0 client-request-id : 9d2707d8-b797-439a-a30e-d94c7e16a61b

Body: { "action": "selfActivate", "scheduleInfo": { "expiration": { "duration": "PT5M", "type": "afterDuration" } }, "accessId": "member", "groupId": "GROUP_ID", "principalId": "PRINCIPAL_ID" }

DEBUG: ============================ HTTP RESPONSE ============================

Status Code: BadRequest

Headers: Transfer-Encoding : chunked Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : ef737aa5-0d1d-43ad-bc4f-844e05171c08 client-request-id : 9d2707d8-b797-439a-a30e-d94c7e16a61b x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Australia East","Slice":"E","Ring":"5","ScaleUnit":"002","RoleInstance":"SY2PEPF00006466"}} Date : Wed, 19 Jun 2024 06:48:51 GMT

Body: { "error": { "code": "RoleAssignmentRequestAcrsValidationFailed", "message": "&claims=%7B%22access_token%22%3A%7B%22acrs%22%3A%7B%22essential%22%3Atrue%2C%20%22value%22%3A%22c1%22%7D%7D%7D", "innerError": { "date": "2024-06-19T06:48:51", "request-id": "ef737aa5-0d1d-43ad-bc4f-844e05171c08", "client-request-id": "9d2707d8-b797-439a-a30e-d94c7e16a61b" } } }

</details>


### Configuration


Name                           Value
----                           -----
PSVersion                      7.4.2
PSEdition                      Core
GitCommitId                    7.4.2
OS                             Microsoft Windows 10.0.17763
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0



### Other information

_No response_

[jeremyhagan]

Added missing cmdlet syntax on steps to reporduce