Edit

Share via

New-AzManagedServicesEligibleAuthorizationObject

Module:
Az.ManagedServices Module

Create a in-memory object for EligibleAuthorization

Syntax

Default (Default) 

New-AzManagedServicesEligibleAuthorizationObject
    -PrincipalId <String>
    -RoleDefinitionId <String>
    [-JustInTimeAccessPolicyManagedByTenantApprover <IEligibleApprover[]>]
    [-JustInTimeAccessPolicyMaximumActivationDuration <TimeSpan>]
    [-JustInTimeAccessPolicyMultiFactorAuthProvider <MultiFactorAuthProvider>]
    [-PrincipalIdDisplayName <String>]
    [<CommonParameters>]

Description

Create a in-memory object for EligibleAuthorization

Examples

Example 1: Creates new Azure Lighthouse eligible authorization object to use with Registration definition

New-AzManagedServicesEligibleAuthorizationObject -PrincipalId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -PrincipalIdDisplayName "Test user" -RoleDefinitionId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

PrincipalId                          PrincipalIdDisplayName RoleDefinitionId
-----------                          ---------------------- ----------------
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Test user              xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Creates new Azure Lighthouse eligible authorization object to use with Registration definition.

Example 2: Create new Azure Lighthouse eligible authorization with JustInTime settings

$approver = New-AzManagedServicesEligibleApproverObject -PrincipalId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -PrincipalIdDisplayName "Approver group"

$eligibleAuth = New-AzManagedServicesEligibleAuthorizationObject -PrincipalId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -PrincipalIdDisplayName "Test user" -RoleDefinitionId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -JustInTimeAccessPolicyManagedByTenantApprover $approver -JustInTimeAccessPolicyMultiFactorAuthProvider Azure -JustInTimeAccessPolicyMaximumActivationDuration 0:30

$eligibleAuth | Format-List -Property PrinciPalId, PrincipalIdDisplayName, RoleDefinitionId, JustInTimeAccessPolicyManagedByTenantApprover, JustInTimeAccessPolicyMultiFactorAuthProvider, JustInTimeAccessPolicyMaximumActivationDuration

PrincipalId                                     : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
PrincipalIdDisplayName                          : Test user
RoleDefinitionId                                : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
JustInTimeAccessPolicyManagedByTenantApprover   : {Approver group}
JustInTimeAccessPolicyMultiFactorAuthProvider   : Azure
JustInTimeAccessPolicyMaximumActivationDuration : 00:30:00

Creates new Azure Lighthouse eligible authorization object with JustInTime (JIT) settings.

Parameters

-JustInTimeAccessPolicyManagedByTenantApprover

The list of managedByTenant approvers for the eligible authorization. To construct, see NOTES section for JUSTINTIMEACCESSPOLICYMANAGEDBYTENANTAPPROVER properties and create a hash table.

Parameter properties

Type:

IEligibleApprover[]

Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-JustInTimeAccessPolicyMaximumActivationDuration

The maximum access duration in ISO 8601 format for just-in-time access requests.

Parameter properties

Type:TimeSpan
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-JustInTimeAccessPolicyMultiFactorAuthProvider

The multi-factor authorization provider to be used for just-in-time access requests.

Parameter properties

Type:MultiFactorAuthProvider
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-PrincipalId

The identifier of the Azure Active Directory principal.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-PrincipalIdDisplayName

The display name of the Azure Active Directory principal.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RoleDefinitionId

The identifier of the Azure built-in role that defines the permissions that the Azure Active Directory principal will have on the projected scope.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Outputs

EligibleAuthorization