As everyone in Technical Community is aware that MSOnline and AzureAD modules will be depreciated.
We have started working on converting our automated solutions to use Microsoft Graph SDK.
This is one of the solutions that utilize MSOL where we have extracted AzureAD roles and their assignments.
Extract office 365 Role Admins | Tech Wizard
I will share the updated script of MgGraph in other blog post , This post is about how we can do the same thing with Microsoft graph SDK.
For MSOL module cmdlets for extracting the Role Admins are:
- Get-MsolRole
- Get-MsolRoleMember
To find out the equivalent in Graph SDK you can refer below Link:
Find Azure AD and MSOnline cmdlets in Microsoft Graph
Equivalent cmdlets in MgGraph are:
- Get-MgDirectoryRole
- Get-MgDirectoryRoleMember
Once you have connected to Graph and use Get-MgDirectoryRole, it does not fetch all the roles that you see in AzureAD whereas Get-MsolRole fetches all roles.
MSOL Roles Count
Graph Cmdlet Role Count
This is where we have found that we need to use another way to extract all roles and then loop thru them.
Get-MgDirectoryRoleTemplate is the Cmdlet that you need to use to get all the roles and then get the id by matching the Role Name.(Get-MgDirectoryRole)
Now utilize Get-MgDirectoryRoleMember to get the members inside that role.
Sample Code:
$collection = @()
$AllRoles =Get-MgDirectoryRoleTemplate
$AllRoles | ForEach-Object{
$adminroleid= $getroleadmins = $null
$rolName = $_.DisplayName
$rolobjid = $_.id
$description = $_.Description
Write-Log -Message "Extracting........$rolName" -path $log
$adminroleid = Get-MgDirectoryRole -Filter "DisplayName eq '$rolName'"
if($adminroleid.id){
$getroleadmins = Get-MgDirectoryRoleMember -DirectoryRoleId $adminroleid.id
}
if($getroleadmins){
$getroleadmins | ForEach-Object{
$mcoll = "" | select USerId, DisplayName, RoleName, RoleMemberType, Description
$uid = $getmguser = $null
$getmguser = Get-MgUser -UserId $_.Id -ea silentlycontinue
if($getmguser){
$uid = $getmguser.UserPrincipalName
$mcoll.USerId = $uid
$mcoll.DisplayName = $getmguser.DisplayName
$mcoll.RoleName = $rolName
$mcoll.RoleMemberType = "User"
$mcoll.description = $description
}
else{
$mgapp=$null
$mgapp = Get-MgServicePrincipal -ServicePrincipalId $_.Id -ea silentlycontinue
if($mgapp){
$mcoll.DisplayName = $mgapp.DisplayName
$mcoll.RoleName = $rolName
$mcoll.RoleMemberType = "ServicePrincipal"
$mcoll.description = $description
}
else{
$mggroup = $null
$mggroup = Get-MgGroup -GroupId $_.Id -ea silentlycontinue
$mcoll.DisplayName = $mggroup.DisplayName
$mcoll.RoleName = $rolName
$mcoll.RoleMemberType = "Group"
$mcoll.description = $description
}
}
$collection += $mcoll
}
}
}
If you are also in transition to MgGraph then this post will assist you in your journey of migration to MS Graph.
Thanks for reading…
Tech Wizard
Tech Wizard 