powershellazure-runbook

Assigning "Desktop Virtualization User" role to users using Azure Runbook

I am trying the below command in Azure Run Book to assign the "Desktop Virtualization User" role to users in an application group. If i execute the same command "Clod Shell", it is working fine. But if i execute the same command from Runbook, i am getting "object reference not set to an object error". Here is the command.

New-AzRoleAssignment -ObjectId $userobjectid -RoleDefinitionName 'Desktop Virtualization User' -ResourceGroupName 'RGName' -ResourceName 'providers/Microsoft.DesktopVirtualization/applicationgroups/AppGroupName' -ResourceType 'Microsoft.DesktopVirtualization' -Verbose

I am a global admin on this tenant and i don't see a reason for failure of the above command related to access. Can somebody please suggest if i am making any mistakes or any limitation for the New-AzRoleAssignment in runbook.

Thanks, Venu

Solution

  • When you do not have appropriate permissions to access a specific resource, an error object reference not set to an instance of an object occurs.

    Need to check below:

    To access users from Azure AD within the automation account, you must first have a "User Access Administrator" or "Owner" roles.

    To assign a role assignment to a user, you need to have an admin consent for the application. However, under registrations, delegated API permissions are usually provided for the apps. Now to delegate permissions for the user, you need to visit graph explorer.

    Go to your profile >> Login >> Consent to Permissions in the upper right corner.

    enter image description here

    Search for Directory.ReadWrite.All once you've opened it and consent by clicking on the consent button.

    enter image description here

    Once you are done with the above, try executing the script and it worked for me as expected.

    connect-Azaccount -identity
$userobjectid = "09fxxxxxxfc9"
New-AzRoleAssignment -ObjectId $userobjectid -RoleDefinitionName "Desktop Virtualization User" -ResourceName "providers/Microsoft.DesktopVirtualization/applicationgroups/newpool-DAG" -ResourceGroupName "Jahnavi" -ResourceType 'Microsoft.DesktopVirtualization' -Verbose

    Output:

    enter image description here

    Role added successfully:

    enter image description here