AzureAD PowerShell New-AzureRmRoleAssignment keeps failing
EDIT:
Ok, the previous "solution" was pure luck... Apparently, the New-AzureRmADServicePrincipal
is created asynchronously. That method does immediately return an object, but the actual principal isn't created immediately...
I worked around this by adding a Start-Sleep -s 15
command.
If this isn't enough, either increase it, or catch the error and wait another few seconds before trying again.
I had the same error but the route cause and solution was different. This was my code:
New-AzureRmRoleAssignment -ObjectId $ServicePrincipal.ApplicationId -RoleDefinitionName $Role -Scope "/subscriptions/$($Subscription.Context.Subscription.Id)"
and it always failed with the same error:
New-AzureRmRoleAssignment : Principal 7dfxxxxxxxxxxxxx1b1 does not exist in the directory 3141xxxxxxxxxxxxxx736.
Waiting did not help.
The issue was resolved by using $ServicePrincipal.Id
instead of $ServicePrincipal.ApplicationId
for the -ObjectId
parameter
Using $ServicePrincipal.ApplicationId
is suggested by Example 5 at https://docs.microsoft.com/en-us/powershell/module/azurerm.resources/new-azurermroleassignment?view=azurermps-5.5.0 which is not correct..