使用Microsoft Graph PowerShell配置Azure AD/Entra ID目录角色设置

我正在编写脚本，通过Microsoft Graph PowerShell配置Azure AD/Entra ID目录角色的各项设置，包括激活时是否需要MFA、审批理由，以及通知规则等。以下是修正后的可运行脚本，解决了原脚本中的语法错误和cmdlet使用问题：

# 启用脚本日志记录
$logFilePath = "C:\Code\scripts\logs\entraidsetdirectoryrolesettings-$(Get-Date -Format "yyyy-MM-dd-HHmmss").log"
Start-Transcript -Path $logFilePath -Append

# 连接Microsoft Graph，所需权限：RoleManagement.ReadWrite.Directory
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory" -NoWelcome

# 导入特权角色ID列表模块
Import-Module "C:\Code\scripts\entraid\entraidallprivilegeddirectoryroles.ps1"
$privilegedroleIds = $global:privilegedroleIds

# 导入角色配置参数模块
Import-Module "C:\Code\scripts\entraid\entraiddirectoryrolesconfig.ps1"
$privilegedroleSettings = $global:privilegedroleSettings
$nonprivilegedroleSettings = $global:nonprivilegedroleSettings

# 获取所有目录角色定义
$roleDefinitions = Get-MgRoleManagementDirectoryRoleDefinition

Write-Output "已检索到 $($roleDefinitions.Count) 个目录角色："
foreach ($roleDefinition in $roleDefinitions) {
    Write-Output "- $($roleDefinition.DisplayName) (ID: $($roleDefinition.Id))"
}

# 遍历每个角色，应用对应配置
foreach ($roleDefinition in $roleDefinitions) {
    # 获取当前角色的设置对象
    $roleSetting = Get-MgRoleManagementDirectoryRoleSetting -Filter "roleDefinitionId eq '$($roleDefinition.Id)'"

    if ($roleDefinition.Id -in $privilegedroleIds) {
        # 组装特权角色的配置参数
        $params = @{
            ActivationMaximumDurationInHours = $privilegedroleSettings['activationMaximumDurationInHoursPriv']
            RequireMfaOnActivation = $privilegedroleSettings['requireMfaOnActivationPriv']
            RequireJustificationOnActivation = $privilegedroleSettings['requireJustificationOnActivationPriv']
            RequireTicketInformationOnActivation = $privilegedroleSettings['requireTicketInformationOnActivationPriv']
            RequireApprovalToActivate = $privilegedroleSettings['requireApprovalToActivatePriv']
            AllowPermanentEligibleAssignment = $privilegedroleSettings['allowPermanentEligibleAssignmentPriv']
            AllowPermanentActiveAssignment = $privilegedroleSettings['allowPermanentActiveAssignmentPriv']
            RequireMfaOnActiveAssignment = $privilegedroleSettings['requireMfaOnActiveAssignmentPriv']
            RequireJustificationOnActiveAssignment = $privilegedroleSettings['requireJustificationOnActiveAssignmentPriv']
            # 通知设置
            RoleAssignmentAlertDefaultRecipients = $privilegedroleSettings['roleAssignmentAlertEligibleDefaultRecipientsPriv']
            RoleAssignmentAlertAssignedUserNotificationDefaultRecipients = $privilegedroleSettings['roleAssignmentAlertEligibleAssignedUserNotificationDefaultRecipientsPriv']
            RoleAssignmentAlertApproverNotificationDefaultRecipients = $privilegedroleSettings['roleAssignmentAlertEligibleApproverNotificationDefaultRecipientsPriv']
            RoleAssignmentAlertCriticalEmailsOnly = $privilegedroleSettings['roleAssignmentAlertEligibleCriticalEmailsOnlyPriv']
            RoleAssignmentAlertAssignedUserNotificationCriticalEmailsOnly = $privilegedroleSettings['roleAssignmentAlertEligibleAssignedUserNotificationCriticalEmailsOnlyPriv']
            RoleAssignmentAlertApproverNotificationCriticalEmailsOnly = $privilegedroleSettings['roleAssignmentAlertEligibleApproverNotificationCriticalEmailsOnlyPriv']
            RoleActivationAlertDefaultRecipients = $privilegedroleSettings['roleActivationAlertDefaultRecipientsPriv']
            RoleActivationAlertCriticalEmailsOnly = $privilegedroleSettings['roleActivationAlertCriticalEmailsOnlyPriv']
            RoleActivationAlertActivatedUserNotificationDefaultRecipients = $privilegedroleSettings['roleActivationAlertActivatedUserNotificationDefaultRecipientsPriv']
            RoleActivationAlertApproverNotificationDefaultRecipients = $privilegedroleSettings['roleActivationAlertApproverNotificationDefaultRecipientsPriv']
        }
    }
    else {
        # 组装非特权角色的配置参数
        $params = @{
            ActivationMaximumDurationInHours = $nonprivilegedroleSettings['activationMaximumDurationInHoursStd']
            RequireMfaOnActivation = $nonprivilegedroleSettings['requireMfaOnActivationStd']
            RequireJustificationOnActivation = $nonprivilegedroleSettings['requireJustificationOnActivationStd']
            RequireTicketInformationOnActivation = $nonprivilegedroleSettings['requireTicketInformationOnActivationStd']
            RequireApprovalToActivate = $nonprivilegedroleSettings['requireApprovalToActivateStd']
            AllowPermanentEligibleAssignment = $nonprivilegedroleSettings['allowPermanentEligibleAssignmentStd']
            AllowPermanentActiveAssignment = $nonprivilegedroleSettings['allowPermanentActiveAssignmentStd']
            RequireMfaOnActiveAssignment = $nonprivilegedroleSettings['requireMfaOnActiveAssignmentStd']
            RequireJustificationOnActiveAssignment = $nonprivilegedroleSettings['requireJustificationOnActiveAssignmentStd']
            # 通知设置
            RoleAssignmentAlertDefaultRecipients = $nonprivilegedroleSettings['roleAssignmentAlertEligibleDefaultRecipientsStd']
            RoleAssignmentAlertAssignedUserNotificationDefaultRecipients = $nonprivilegedroleSettings['roleAssignmentAlertEligibleAssignedUserNotificationDefaultRecipientsStd']
            RoleAssignmentAlertApproverNotificationDefaultRecipients = $nonprivilegedroleSettings['roleAssignmentAlertEligibleApproverNotificationDefaultRecipientsStd']
            RoleAssignmentAlertCriticalEmailsOnly = $nonprivilegedroleSettings['roleAssignmentAlertEligibleCriticalEmailsOnlyStd']
            RoleAssignmentAlertAssignedUserNotificationCriticalEmailsOnly = $nonprivilegedroleSettings['roleAssignmentAlertEligibleAssignedUserNotificationCriticalEmailsOnlyStd']
            RoleAssignmentAlertApproverNotificationCriticalEmailsOnly = $nonprivilegedroleSettings['roleAssignmentAlertEligibleApproverNotificationCriticalEmailsOnlyStd']
            RoleActivationAlertDefaultRecipients = $nonprivilegedroleSettings['roleActivationAlertDefaultRecipientsStd']
            RoleActivationAlertCriticalEmailsOnly = $nonprivilegedroleSettings['roleActivationAlertCriticalEmailsOnlyStd']
            RoleActivationAlertActivatedUserNotificationDefaultRecipients = $nonprivilegedroleSettings['roleActivationAlertActivatedUserNotificationDefaultRecipientsStd']
            RoleActivationAlertApproverNotificationDefaultRecipients = $nonprivilegedroleSettings['roleActivationAlertApproverNotificationDefaultRecipientsStd']
        }
    }

    # 更新角色设置
    Update-MgRoleManagementDirectoryRoleSetting -UnifiedRoleSettingId $roleSetting.Id -BodyParameter $params
    Write-Output "已更新角色 $($roleDefinition.DisplayName) 的设置"
}

# 断开Graph连接
Disconnect-MgGraph

Stop-Transcript

关键修正点说明 #

• Cmdlet替换：原脚本错误使用Update-MgDirectoryRole修改角色配置，正确应该用Update-MgRoleManagementDirectoryRoleSetting——因为角色的MFA、审批等设置存储在独立的角色设置对象中，而非角色定义本身。
• 语法修复：补全了注释的#标识，修复了if/else的括号不匹配问题，统一用哈希表传递参数避免重复调用API。
• 参数格式修正：原脚本参数缺少-前缀、赋值符号使用错误，现在改为PowerShell标准的参数传递方式。
• 效率优化：将同一角色的所有配置项合并到一次Update调用中，减少API请求次数。

内容的提问来源于stack exchange，提问作者Oliver Betts-Richards