45 lines
1.5 KiB
PowerShell
45 lines
1.5 KiB
PowerShell
# Script to add user to an AzureAD role
|
|
|
|
<#
|
|
You can find a list of available roles in the following Microsoft article
|
|
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign-admin-roles-azure-portal
|
|
Double check using Get-AzureADDirectoryRole as they don't always have the same name in PowerShell as the GUI
|
|
|
|
Built from the code example on the following Mircosoft page
|
|
https://docs.microsoft.com/en-us/powershell/module/azuread/add-azureaddirectoryrolemember?view=azureadps-2.0
|
|
#>
|
|
|
|
|
|
# User UPN to assign role to
|
|
$roleUser = ''
|
|
|
|
# Role Name to Assign
|
|
$roleName = ''
|
|
|
|
|
|
# Import AzureAD module and Connect
|
|
Import-Module AzureAD
|
|
Connect-AzureAD
|
|
|
|
# Fetch user to assign to role
|
|
$roleMember = Get-AzureADUser -ObjectId $roleUser
|
|
|
|
# Fetch role instance
|
|
$role = Get-AzureADDirectoryRole | Where-Object {$_.displayName -eq $roleName}
|
|
|
|
# If role instance does not exist, instantiate it based on the role template
|
|
if (!($role)) {
|
|
# Instantiate an instance of the role template
|
|
$roleTemplate = Get-AzureADDirectoryRoleTemplate | Where-Object {$_.displayName -eq $roleName}
|
|
Enable-AzureADDirectoryRole -RoleTemplateId $roleTemplate.ObjectId
|
|
|
|
# Fetch role instance again
|
|
$role = Get-AzureADDirectoryRole | Where-Object {$_.displayName -eq $roleName}
|
|
}
|
|
|
|
# Add user to role
|
|
Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $roleMember.ObjectId
|
|
|
|
# Fetch role membership for role to confirm
|
|
Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId | Get-AzureADUser
|