IGA Commands are getting a 403 error after Module version v2.25.0

首先，在不具备 catalog-owner 或 Global Admin 访问权限的情况下，使用提升的 Identity Governance 角色重现 Get-MgBetaEntitlementManagementAccessPackage。使用提供的调试请求和 403 响应，将 2.25.0 中成功的行为与 2.28.0 及最新版本进行比较。当该命令能够在不要求目录所有权的情况下供 IGA 角色使用时，即视为完成。

Describe the bug

There is a bug with the PowerShell SDK. After doing some troubleshooting, I found out that Graph Module 2.25.0 is the last version that works with Identity Governance role.

For context, Anytime I run IGA commands on the newer versions of the graph module, I get a 403 error (see attached screenshot). The commands only work if I add myself as a catalog owner (which kind of defeats the purpose of the IGA role and elevating the role). I tested this on my own prod tenant and my lab tenant, results were the same.

This can also be replicated by running the following command while elevated to the IGA role (and not added as a catalog owner or Global admin):

Get-MgBetaEntitlementManagementAccessPackage -AccessPackageId <guid>

Expected behavior

The commands work as expected like they were prior to Graph Module 2.25.0 and earlier.

How to reproduce

This can also be replicated by running the following command while elevated to the IGA role (and not added as a catalog owner or Global admin):

Get-MgBetaEntitlementManagementAccessPackage -AccessPackageId <guid>

SDK Version

2.28.0 to latest no longer work

Latest version known to work for scenario above?

2.25.0

Known Workarounds

I have to add myself as a catalog owner to EACH catalog as a workaround to the 403 error. Adding myself as a catalog owner when I am an IGA admin defeats the purpose of the Entra ID role.

Debug output

 Get-MgBetaEntitlementManagementAccessPackage -AccessPackageId 10cb7633-2b28-4809-883a-0064aacf7170 -Debug


DEBUG: [CmdletBeginProcessing]: - Get-MgBetaEntitlementManagementAccessPackage begin processing with parameterSet 'Get'.
DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope: 'CurrentUser', AppName: 'Microsoft Graph Command Line Tools'.
DEBUG: [Authentication]: - Scopes: [AccessReview.Read.All, AccessReview.ReadWrite.All, AdministrativeUnit.ReadWrite.All, AppCatalog.Read.All, Application.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, AuditLog.Read.All, AuthenticationContext.ReadWrite.All, BitlockerKey.Read.All, Calendars.Read, Calendars.ReadWrite, ChannelMessage.Read.All, ChannelMessage.ReadWrite, Chat.Create, Chat.Read, Chat.ReadBasic, Chat.ReadWrite, ChatMessage.Read, ChatMessage.Send, CrossTenantInformation.ReadBasic.All, Device.Read.All, Device.ReadWrite.All, DeviceManagementApps.Read.All, DeviceManagementApps.ReadWrite.All, DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementRBAC.ReadWrite.All, DeviceManagementServiceConfig.ReadWrite.All, Directory.AccessAsUser.All, Directory.Read.All, Directory.ReadWrite.All, Domain.ReadWrite.All, eDiscovery.Read.All, eDiscovery.ReadWrite.All, email, EntitlementManagement.Read.All, EntitlementManagement.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.ReadWrite.All, IdentityRiskyUser.ReadWrite.All, Mail.Read, OnlineMeetings.Read, OnlineMeetingTranscript.Read.All, openid, Organization.Read.All, Policy.Read.All, Policy.ReadWrite.ApplicationConfiguration, Policy.ReadWrite.Authorization, Policy.ReadWrite.PermissionGrant, profile, RoleAssignmentSchedule.ReadWrite.Directory, RoleEligibilitySchedule.ReadWrite.Directory, RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory, Sites.Read.All, Tasks.Read, Team.ReadBasic.All, TeamSettings.Read.All, TeamworkAppSettings.ReadWrite.All, User.Read, User.Read.All, User.ReadWrite, User.ReadWrite.All, UserAuthenticationMethod.Read.All, UserAuthenticationMethod.ReadWrite.All, User-LifeCycleInfo.ReadWrite.All].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/10cb7633-2b28-4809-883a-0064aacf7170

Headers:
FeatureFlag                   : 00000003
Cache-Control                 : no-store, no-cache
User-Agent                    : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26200; en-US),PowerShell/7.5.4
SdkVersion                    : graph-powershell-beta/2.33.0
client-request-id             : b38f7c76-454c-448c-891c-5130b484369a
Accept-Encoding               : gzip,deflate,br

Body:



DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Forbidden

Headers:
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 2b0f874e-3544-4ee2-a430-5c1fd38cef99
client-request-id             : b38f7c76-454c-448c-891c-5130b484369a
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"West US","Slice":"E","Ring":"4","ScaleUnit":"003","RoleInstance":"SJ1PEPF00001D38"}}
Date                          : Tue, 16 Dec 2025 17:41:39 GMT

Body:
{
  "error": {
    "code": "UnAuthorized",
    "message": "User is not authorized to perform the operation. Reason: Unauthorized",
    "details": [],
    "innerError": {
      "date": "2025-12-16T17:41:39",
      "request-id": "2b0f874e-3544-4ee2-a430-5c1fd38cef99",
      "client-request-id": "b38f7c76-454c-448c-891c-5130b484369a"
    }
  }
}


Get-MgBetaEntitlementManagementAccessPackage_Get: User is not authorized to perform the operation. Reason: Unauthorized

Status: 403 (Forbidden)
ErrorCode: UnAuthorized
Date: 2025-12-16T17:41:39

Headers:
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 2b0f874e-3544-4ee2-a430-5c1fd38cef99
client-request-id             : b38f7c76-454c-448c-891c-5130b484369a
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"West US","Slice":"E","Ring":"4","ScaleUnit":"003","RoleInstance":"SJ1PEPF00001D38"}}
Date                          : Tue, 16 Dec 2025 17:41:39 GMT


  Recommendation: See service error codes: https://learn.microsoft.com/graph/errors
DEBUG: [CmdletEndProcessing]: - Get-MgBetaEntitlementManagementAccessPackage end processing.

### Configuration

PS C:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.5.4
PSEdition                      Core
GitCommitId                    7.5.4
OS                             Microsoft Windows 10.0.26200
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Other information

No response