Get-MgBetaRoleManagementEntitlementManagementRoleDefinition returns empty when filtering by DisplayName 'AccessPackage assignment manager' using eq logic
メンテナーはふだん 1 日以内に返信
まだ誰も着手していません。
評価
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 初心者へのやさしさ
- 35/100
調査の方向性
ドキュメント化されている Get-MgBetaRoleManagementEntitlementManagementRoleDefinition cmdlet と、デバッグ出力に示されている beta roleDefinitions endpoint から始めます。指定されたロールに対する DisplayName eq、Id eq、startswith のリクエストを比較し、その挙動が PowerShell SDK に属するのか Graph service に属するのかを判断します。完了の条件は、正確な DisplayName 等価フィルターが他のフィルターと一貫してロール定義を返すことです。
索引モデルが issue の本文から書いたものです。
説明
Describe the bug
I am attempting to filter entitlement management role definitions using the Microsoft Graph Beta PowerShell SDK. When utilizing the Get-MgBetaRoleManagementEntitlementManagementRoleDefinition cmdlet with an OData filter on the DisplayName property, using the equality operator (eq) fails silently and returns an empty result specifically for the built-in role "AccessPackage assignment manager".
This behavior is highly inconsistent and points to a localized parsing or backend API string-matching bug because:
- The role explicitly exists in the tenant. Running the cmdlet with no filters lists it clearly alongside other roles like "Catalog owner" and "Catalog reader".
- Querying by the direct ID (
Id eq 'e2182095-804a-4656-ae11-64734e9b7ae5') works perfectly and returns the item. - The OData equality filter (
eq) works perfectly fine for other roles retrieved in the exact same dataset, such asDisplayName eq 'Catalog owner'. - Using a string manipulation OData filter function like
startswith(displayName,'AccessPackage assignment manager')successfully evades the bug and returns the resource.
The exact matching evaluation breaks down solely when an absolute equality logic string match is forced against "AccessPackage assignment manager".
Expected behavior
When executing the command with an exact string equality filter matching a known role definition:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "DisplayName eq 'AccessPackage assignment manager'"
The underlying Graph API call should successfully evaluate the string and return the corresponding directory role definition object, matching the consistent behavior observed when performing equality filters against other default roles like 'Catalog owner'.
Specifically, it should return the following object output instead of an empty line:
DisplayName Id TemplateId Description IsBuiltIn
----------- -- ---------- ----------- ---------
AccessPackage assignment manager e2182095-804a-4656-ae11-64734e9b7ae5 e2182095-804a-4656-ae11-64734e9b7ae5 AccessPackage assignment manager True
How to reproduce
Execute the following steps in an authenticated Microsoft Graph PowerShell terminal session containing the Microsoft.Graph.Beta.Identity.Governance module:
- List all available roles to confirm presence and verify the literal string spacing of the target role name:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition
- Execute a control test using the
eqfilter on a different role to prove the query syntax and module filtering capabilities are functional:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "DisplayName eq 'Catalog owner'"
# Output: Returns the "Catalog owner" role definition object successfully.
- Query the target role directly by its ID to confirm it is valid, indexed, and fully accessible in the backend database:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "Id eq 'e2182095-804a-4656-ae11-64734e9b7ae5'"
# Output: Returns the "AccessPackage assignment manager" object successfully.
- Run a workaround query utilizing
startswithto demonstrate that partial string comparison functions evaluate the entry successfully:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "startswith(displayName,'AccessPackage assignment manager')"
# Output: Returns the "AccessPackage assignment manager" object successfully.
- Run the problematic query with absolute equality to observe the bug:
Get-MgBetaRoleManagementEntitlementManagementRoleDefinition -Filter "DisplayName eq 'AccessPackage assignment manager'"
# Output: Returns absolutely nothing (Null/Empty response).
SDK Version
2.38.0
Latest version known to work for scenario above?
No response
Known Workarounds
No response
Debug output
Click to expand log
```DEBUG: [CmdletBeginProcessing]: - Get-MgBetaRoleManagementEntitlementManagementRoleDefinition begin processing with parameterSet 'List'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [AccessReview.Read.All, AccessReview.ReadWrite.All, Agreement.Read.All, Application.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, AuditLog.Read.All, AuditLogsQuery.Read.All, AuthenticationContext.Read.All, BitlockerKey.Read.All, BitlockerKey.ReadBasic.All, ConsentRequest.Read.All, CrossTenantInformation.ReadBasic.All, DelegatedPermissionGrant.ReadWrite.All, Device.Read.All, Device.ReadWrite.All, DeviceLocalCredential.ReadBasic.All, DeviceManagementApps.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, DeviceManagementServiceConfig.ReadWrite.All, Directory.AccessAsUser.All, Directory.Read.All, Directory.ReadWrite.All, DirectoryRecommendations.Read.All, Domain.Read.All, email, EntitlementManagement.Read.All, EntitlementManagement.ReadWrite.All, ExternalConnection.Read.All, Files.Read.All, Files.ReadWrite, Files.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, GroupMember.ReadWrite.All, Group-OnPremisesSyncBehavior.ReadWrite.All, IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, Insights-UserMetrics.Read.All, LicenseAssignment.Read.All, LifecycleWorkflows.ReadWrite.All, MailboxSettings.Read, MailboxSettings.ReadWrite, NetworkAccess.ReadWrite.All, NetworkAccessPolicy.ReadWrite.All, openid, Organization.Read.All, OrgSettings-Forms.Read.All, Place.Read.All, Policy.Read.All, Policy.Read.ConditionalAccess, Policy.Read.PermissionGrant, Policy.ReadWrite.ApplicationConfiguration, Policy.ReadWrite.Authorization, Policy.ReadWrite.ConditionalAccess, Printer.ReadWrite.All, PrivilegedAccess.Read.AzureAD, PrivilegedAccess.Read.AzureADGroup, PrivilegedAccess.ReadWrite.AzureADGroup, profile, Reports.Read.All, RoleAssignmentSchedule.Read.Directory, RoleEligibilitySchedule.Read.Directory, RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.Read.All, RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory, RoleManagementPolicy.Read.AzureADGroup, RoleManagementPolicy.Read.Directory, RoleManagementPolicy.ReadWrite.AzureADGroup, Sites.FullControl.All, Sites.Read.All, Sites.ReadWrite.All, SynchronizationData-User.Upload, Tasks.Read, Team.ReadBasic.All, ThreatHunting.Read.All, User.DeleteRestore.All, User.Read, User.Read.All, User.ReadBasic.All, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All].
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
GET
Absolute Uri:
https://graph.microsoft.com/beta/roleManagement/entitlementManagement/roleDefinitions?$filter=DisplayName eq %27AccessPackage assignment manager%27
Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26200; en-CH),PowerShell/7.6.2
SdkVersion : graph-powershell-beta/2.38.0
client-request-id : 4067d11f-1c21-4847-9b7e-513b3009d2cf
Accept-Encoding : gzip,deflate
Body:
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
OK
Headers:
Date : Thu, 18 Jun 2026 07:44:50 GMT
Transfer-Encoding : chunked
Connection : keep-alive
Cache-Control : private
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 00697b0d-08b4-4a6c-940d-453aa5791b37
client-request-id : 4067d11f-1c21-4847-9b7e-513b3009d2cf
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Switzerland North","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"ZRH2EPF000000EC"}}
Link : https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:microsoft.applicationAuthorization&from=2025-01-01&to=2025-02-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html",https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=beta,PrivatePreview:unifiedRbacImprovements&from=2024-05-01&to=2024-06-01;rel="deprecation";type="text/html"
Deprecation : Tue, 21 May 2024 23:59:59 GMT
Sunset : Thu, 21 May 2026 23:59:59 GMT
OData-Version : 4.0
X-Cache : CONFIG_NOCACHE
Body:
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/entitlementManagement/roleDefinitions",
"value": []
}
DEBUG: [CmdletEndProcessing]: - Get-MgBetaRoleManagementEntitlementManagementRoleDefinition end processing.
</details>
### Configuration
_No response_
### Other information
_No response_
- 主要言語
- C#
- スター
- 902
- フォーク
- 233
- 平均マージ
- 1日 20時間
- マージ済み PR(30日)
- 30
環境構築
- Dockerfile または Docker Compose ファイルあり
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
microsoftgraph/msgraph-sdk-powershell のほかの issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 84/100
microsoftgraph/msgraph-sdk-powershell#3752 ·
メンテナーはふだん 1 日以内に返信
-
status:waiting-for-triage type:bug
難易度 4/5 3〜5日 初心者へのやさしさ 22/100
microsoftgraph/msgraph-sdk-powershell#3822 ·
メンテナーはふだん 1 日以内に返信
-
Microsoft.Graph.Authentication dependency Microsoft.Graph.Authentication.Loader.dll is unsignedオープンstatus:waiting-for-triage type:bug
難易度 4/5 3〜5日 初心者へのやさしさ 48/100
microsoftgraph/msgraph-sdk-powershell#3819 ·
メンテナーはふだん 1 日以内に返信
-
Connect-MgGraph on 2.41 crashes when making a connection with cert, fixes when using 2.39 or lowerオープンstatus:waiting-for-triage type:bug
難易度 4/5 3〜5日 初心者へのやさしさ 48/100
microsoftgraph/msgraph-sdk-powershell#3816 ·
メンテナーはふだん 1 日以内に返信
-
status:waiting-for-triage type:feature
難易度 4/5 3〜5日 初心者へのやさしさ 45/100
microsoftgraph/msgraph-sdk-powershell#3806 · コメント 3 件 · リアクション 3 件 ·
メンテナーはふだん 1 日以内に返信
microsoftgraph/msgraph-sdk-powershell の issue をすべて見る
似ている issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
AvaloniaUI/Avalonia#22420 ·
メンテナーはふだん 1 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 90/100
dotnet/SqlClient#4823 · コメント 1 件 ·
メンテナーはふだん 2 日以内に返信
-
type/automation type/tech-debt
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
clockworklabs/SpacetimeDB#6124 ·
メンテナーはふだん 1 日以内に返信
-
area-integrations
難易度 2/5 1〜3時間 初心者へのやさしさ 68/100
メンテナーはふだん 1 日以内に返信