Powershell: Subject not found

Question

I figured out role assignment in a past post, but eligibility is still giving me a little difficulty.

I use the following to assign the built in Auth admin role to a group, and scope it to an Admin Unit.

$params = @{
    Action = "adminAssign"
    Justification = "Assign Auth Admin eligibility to group"
    RoleDefinitionId = "c4e39bd9-1100-46d3-8c65-fb160da0071f" #Auth admin role ID
    DirectoryScopeId = '/administrativeUnits/{0}' -f $AdminUnit
    PrincipalId = $Id
    ScheduleInfo = @{
        StartDateTime = Get-Date
        Expiration = @{
            Type = "noExpiration"
         }
    }
}

New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params

However despite adapting my prior code I keep getting the following error.

New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest : The subject is not found.
Status: 404 (NotFound)
ErrorCode: SubjectNotFound

I'm not sure exactly what is not found, nor why it's not finding it. Can I request some guidance here?

My prior code was successful:

$params = @{
      "@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
      #Auth Admin
    roleDefinitionId = "c4e39bd9-1100-46d3-8c65-fb160da0071f"
      principalId = $Id
      directoryScopeId = '/administrativeUnits/"{0}"' -f $AdminUnit
}

New-MgRoleManagementDirectoryRoleAssignment -BodyParameter $params```

Error code suggests it failed to resolve one of the identifiers (eg. for the role definition, the principal, or the scope) - what does $AdminUnit contain? If it contains a response from Get-MgDirectoryAdministrativeUnit then you probably want to use just the id, eg: '/administrativeUnits/{0}' -f $AdminUnit.Id — Mathias R. Jessen
– Mathias R. Jessen, Commented Feb 10 at 17:24
That is output pulled from earlier in the script: $AdminUnit = Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq '$AuName'" | Select -Expand Id — BPengu
– BPengu, Commented Feb 10 at 17:29
Right, so you want DirectoryScopeId = '/administrativeUnits/{0}' -f $AdminUnit.Id — Mathias R. Jessen
– Mathias R. Jessen, Commented Feb 10 at 17:46
Make sure you dont have the issue as in your previous question, ensure that $AdminUnit and $Id are GUIDs instead of an object having an Id property. The rest, the Body for the request looks fine so that could be the only issue. — Santiago Squarzon
– Santiago Squarzon, Commented Feb 10 at 17:49
Hmmm, ok there are 2 things you can test, first use [datetime]::UtcNow instead of Get-Date. And if that fails, test with Invoke-MgGraphRequest POST 'v1.0/roleManagement/directory/roleEligibilityScheduleRequests' -Body $params, the API might give a better error response that can help us determine what is wrong — Santiago Squarzon
– Santiago Squarzon, Commented Feb 10 at 18:25

TylerH · Accepted Answer · 2025-06-17 21:58:55Z

0

I added Start-Sleep -Seconds 5 between the creation of the group and the provisioning of the role and it works. It appears there is enough latency that the role provisioning really was not finding the group because Entra did not provision it yet.

edited Jun 17 at 21:58

TylerH

21.3k84 gold badges84 silver badges121 bronze badges

answered Feb 10 at 18:43

BPengu

1421 silver badge13 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

TylerH Jun 17 at 21:59

In general with anything related to Microsoft 365 or Azure, you should expect anywhere from 15 minutes to a couple of hours between any action to rely on it being completed.

Collectives™ on Stack Overflow

Powershell: Subject not found

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related