调用Update-MgPolicyRoleManagementPolicyRule编辑Azure PIM策略无效

你的脚本执行无报错但未启用MFA，核心问题出在规则ID不匹配以及潜在的策略获取逻辑疏漏，以下是具体修复步骤：

1. 修正规则ID不匹配问题 #

你定义的要更新的规则ID是Enablement_Admin_Assignment，但参数$params里的id却是Enablement_EndUser_Assignment，这导致你实际更新的是管理员角色的启用规则，而非终端用户的成员角色规则。需要将规则ID统一为终端用户对应的ID：

# 替换原来的Admin规则ID为EndUser的
$unifiedRoleManagementPolicyRuleId = "Enablement_EndUser_Assignment"

2. 完善策略获取的容错逻辑 #

Get-MgPolicyRoleManagementPolicyAssignment可能返回多个结果或为空，需要确保只获取有效策略并提前终止无效执行：

$pim_policy = Get-MgPolicyRoleManagementPolicyAssignment -Filter "scopeId eq '{0}' and scopeType eq 'Group' and RoleDefinitionId eq 'member'" -f $groupId | Select-Object -First 1

if (!$pim_policy) {
    Write-Host "[$(Get-Date)] 无法获取该组的PIM策略信息"
    return # 直接退出函数，避免后续无效操作
}

3. 增加规则存在性校验与结果验证 #

在执行更新前先确认目标规则存在，更新后验证结果，便于排查问题：

# 检查目标规则是否存在
$currentRule = Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $unifiedRoleManagementPolicyId -UnifiedRoleManagementPolicyRuleId $unifiedRoleManagementPolicyRuleId
if (!$currentRule) {
    Write-Host "[$(Get-Date)] 未找到目标规则 $unifiedRoleManagementPolicyRuleId"
    return
}
Write-Host "当前规则启用项：$($currentRule.enabledRules -join ', ')"

# 更新后验证结果
$updatedRule = Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $unifiedRoleManagementPolicyId -UnifiedRoleManagementPolicyRuleId $unifiedRoleManagementPolicyRuleId
Write-Host "更新后规则启用项：$($updatedRule.enabledRules -join ', ')"

完整修复后的函数代码 #

Function EditPIM($groupId){
    # 获取组对应的PIM策略分配（取第一个有效结果）
    $pim_policy = Get-MgPolicyRoleManagementPolicyAssignment -Filter "scopeId eq '{0}' and scopeType eq 'Group' and RoleDefinitionId eq 'member'" -f $groupId | Select-Object -First 1

    $unifiedRoleManagementPolicyId = $pim_policy.PolicyId
    if (!$unifiedRoleManagementPolicyId){
        Write-Host "[$(Get-Date)] 无法获取该组ID的策略信息"
        return
    }else{
        Write-Host "获取到MFA策略ID：$unifiedRoleManagementPolicyId"
    }

    # 明确指定要更新的终端用户启用规则ID
    $unifiedRoleManagementPolicyRuleId = "Enablement_EndUser_Assignment"

    # 检查目标规则是否存在
    $currentRule = Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $unifiedRoleManagementPolicyId -UnifiedRoleManagementPolicyRuleId $unifiedRoleManagementPolicyRuleId
    if (!$currentRule) {
        Write-Host "[$(Get-Date)] 未找到目标规则：$unifiedRoleManagementPolicyRuleId"
        return
    }
    Write-Host "当前规则启用项：$($currentRule.enabledRules -join ', ')"

    # 构造更新参数
    $params = @{
        "@odata.type" = "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule"
        id = $unifiedRoleManagementPolicyRuleId
        enabledRules = @(
            "Justification"
            "MultiFactorAuthentication"
        )
        target = @{
            "@odata.type" = "microsoft.graph.unifiedRoleManagementPolicyRuleTarget"
            caller = "EndUser"
            operations = @("All")
            level = "Assignment"
            inheritableSettings = @()
            enforcedSettings = @()
        }
    }

    # 执行更新并捕获异常
    try {
        Update-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $unifiedRoleManagementPolicyId -UnifiedRoleManagementPolicyRuleId $unifiedRoleManagementPolicyRuleId -BodyParameter $params -ErrorAction Stop
        Write-Host "[$(Get-Date)] PIM策略更新成功"
        # 验证更新结果
        $updatedRule = Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $unifiedRoleManagementPolicyId -UnifiedRoleManagementPolicyRuleId $unifiedRoleManagementPolicyRuleId
        Write-Host "更新后规则启用项：$($updatedRule.enabledRules -join ', ')"
    } catch {
        Write-Host "[$(Get-Date)] 更新失败：$($_.Exception.Message)"
    }
}

额外注意事项 #

• 确保执行脚本的账号拥有Privileged Role Administrator或Global Administrator权限，否则可能出现无报错但实际未更新的情况。
• PIM策略更新可能存在延迟，建议等待1-2分钟后再检查策略状态。

内容的提问来源于stack exchange，提问作者learner