fix(cippdb): cache PIM role data with app token

Add the required RoleManagement permissions to SAMManifest and update PIM cache jobs to use app-only Graph calls (`-AsApp`) so role APIs stop failing with unauthorized delegated access. Role assignment and eligibility schedule caching now expands `principal` to preserve member identity fields, and role management policy caching now reads `roleManagementPolicyAssignments` (with required filter/expands) and flattens policy rules/effectiveRules alongside `roleDefinitionId` for role-to-policy lookups.

Author: Zacgoose

Config/SAMManifest.json

@@ -582,6 +582,34 @@
         {
           "id": "b7887744-6746-4312-813d-72daeaee7e2d",
           "type": "Scope"
+        },
+        {
+          "id": "dd199f4a-f148-40a4-a2ec-f0069cc799ec",
+          "type": "Role"
+        },
+        {
+          "id": "8c026be3-8e26-4774-9372-8d5d6f21daff",
+          "type": "Scope"
+        },
+        {
+          "id": "fee28b28-e1f3-4841-818e-2704dc62245f",
+          "type": "Role"
+        },
+        {
+          "id": "62ade113-f8e0-4bf9-a6ba-5acb31db32fd",
+          "type": "Scope"
+        },
+        {
+          "id": "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8",
+          "type": "Role"
+        },
+        {
+          "id": "31e08e0a-d3f7-4ca2-ac39-7343fb83e8ad",
+          "type": "Role"
+        },
+        {
+          "id": "1ff1be21-34eb-448c-9ac9-ce1f506b2a68",
+          "type": "Scope"
         }
       ]
     },
@@ -689,4 +717,4 @@
     "isEnabled": true,
     "allProperties": true
   }
-}
+}

Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheRoleAssignmentScheduleInstances.ps1

@@ -18,7 +18,17 @@ function Set-CIPPDBCacheRoleAssignmentScheduleInstances {
 
     try {
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching role assignment schedule instances' -sev Debug
-        New-GraphGetRequest -Uri 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances' -tenantid $TenantFilter -Stream |
+        # -AsApp is required: the RoleManagement.*.Directory grant is an APPLICATION permission,
+        # so it only appears in an app-only token. The default delegated path (service account +
+        # GDAP) fails with "Attempted to perform an unauthorized operation" because PIM reads via
+        # delegated access additionally need the signed-in user to hold a directory role such as
+        # Privileged Role Administrator, which GDAP does not grant.
+        # $expand=principal is required by Get-CippDbRoleMembers, which reads
+        # $member.principal.displayName/.userPrincipalName/.'@odata.type'. The API returns only
+        # principalId (a GUID) by default, so without this those all resolve to $null and every
+        # role member surfaces with a blank name.
+        $Uri = 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$expand=principal'
+        New-GraphGetRequest -Uri $Uri -tenantid $TenantFilter -AsApp $true -Stream |
             Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RoleAssignmentScheduleInstances' -AddCount
 
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached role assignment schedule instances successfully' -sev Debug

Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheRoleEligibilitySchedules.ps1

@@ -18,7 +18,12 @@ function Set-CIPPDBCacheRoleEligibilitySchedules {
 
     try {
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching role eligibility schedules' -sev Debug
-        New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleEligibilitySchedules' -tenantid $TenantFilter -Stream |
+        # -AsApp is required: RoleManagement.*.Directory is an APPLICATION permission and only
+        # lands in an app-only token. The default delegated path returns "unauthorized".
+        # $expand=principal — see the note in Set-CIPPDBCacheRoleAssignmentScheduleInstances;
+        # Get-CippDbRoleMembers reads principal.displayName off these records too.
+        $Uri = 'https://graph.microsoft.com/beta/roleManagement/directory/roleEligibilitySchedules?$expand=principal'
+        New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -Stream |
             Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RoleEligibilitySchedules' -AddCount
 
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached role eligibility schedules successfully' -sev Debug

Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheRoleManagementPolicies.ps1

@@ -1,13 +1,36 @@
 function Set-CIPPDBCacheRoleManagementPolicies {
     <#
     .SYNOPSIS
-        Caches role management policies for a tenant
+        Caches PIM role management policies for a tenant, keyed by the role they apply to
 
     .PARAMETER TenantFilter
         The tenant to cache role management policies for
 
     .PARAMETER QueueId
         The queue ID to update with total tasks (optional)
+
+    .NOTES
+        Reads roleManagementPolicyAssignments, NOT roleManagementPolicies, because only the
+        assignment carries roleDefinitionId — the policy record does not identify the role it
+        applies to, and the role id is not derivable from it (its id embeds a policy GUID that
+        matches no roleTemplateId). Consumers need to find "the policy for role X", so the
+        assignment is the correct entity.
+        https://learn.microsoft.com/graph/api/policyroot-list-rolemanagementpolicyassignments
+
+        $filter is REQUIRED by this API — it must be scoped to a scopeId and scopeType, and the
+        request errors without it. rules/effectiveRules are navigation properties on the policy,
+        so they need a nested $expand; they are absent from the default response and consumers
+        read both.
+
+        The policy is flattened up one level so cached records expose roleDefinitionId alongside
+        rules/effectiveRules, which is the shape the tests consume. This costs -Stream (the
+        Select-Object has to materialize), but the result set is small (~144 records/tenant).
+
+        -AsApp is required: RoleManagement.*.Directory is an APPLICATION permission and only
+        lands in an app-only token. The default delegated path returns "unauthorized".
+
+        A tenant that has never onboarded PIM returns "MissingProvider: The provider is missing"
+        regardless of query or permissions. That is tenant state, not a bug in this call.
     #>
     [CmdletBinding()]
     param(
@@ -18,7 +41,12 @@ function Set-CIPPDBCacheRoleManagementPolicies {
 
     try {
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching role management policies' -sev Debug
-        New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/roleManagementPolicies' -tenantid $TenantFilter -Stream |
+
+        $Uri = "https://graph.microsoft.com/beta/policies/roleManagementPolicyAssignments?`$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'&`$expand=policy(`$expand=rules,effectiveRules)"
+        New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true |
+            Select-Object -Property policyId, roleDefinitionId, scopeId, scopeType,
+            @{ Name = 'rules'; Expression = { $_.policy.rules } },
+            @{ Name = 'effectiveRules'; Expression = { $_.policy.effectiveRules } } |
             Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RoleManagementPolicies' -AddCount
 
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached role management policies successfully' -sev Debug