unable to activate my PIM role using PowerShell using New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest. It keeps failing with "policy rules failed: ["MfaRule"]

Question

unable to activate my PIM role using PowerShell using New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest. It keeps failing with "policy rules failed: ["MfaRule"]

CassidyKevinJOIT-5987 20

I issue connect-mggraph and interactively sign in. When I call the New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest cmdlet, It returns an error:

New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest_Create: The following policy rules failed: ["MfaRule"]

Status: 400 (BadRequest)

ErrorCode: RoleAssignmentRequestPolicyValidationFailed

and the sign in logs show sign in error 500186 - user not allowed by policy conditions with Additional details showing "user needs to perform multi factor authentication"
however, i wasnt prompted for any additional MFA. I have the Authenticator app, but there is no prompt to check it for sign in.

Andy David - MVP 160.4K Reputation points MVP Volunteer Moderator

2025-09-05T19:08:14.1066667+00:00

Is that the same device for MFA registered with your account? in other words, is the MFA prompt going to another phone? Does it work for other apps? Did it ever work for this?
Raja Pothuraju 47,840 Reputation points Microsoft Employee Moderator

2025-09-05T19:14:12.0966667+00:00
Hello CassidyKevinJOIT-5987,

Are you running these commands in PowerShell?

It looks like there is an active session already running in your PowerShell window, which is why it didn’t prompt you for Username + Password + MFA.

To resolve this, try running:

Disconnect-MgGraph

Once disconnected, run:

Connect-MgGraph

and check if this prompts you for MFA and allows you to sign in successfully.
CassidyKevinJOIT-5987 20 Reputation points

2025-09-05T19:43:51.9+00:00

I do call Disconnect-MgGraph at the very start of the script or session.
CassidyKevinJOIT-5987 20 Reputation points

2025-09-05T19:51:33.85+00:00

The account's Authentication methods has Microsoft Authenticator as the only usable auth method and Phone App Notification as the system preferred MFA method. However, I never received prompting on the phone. Note: I have no issues using Azure portal / EntraID to activate the PIM role. When MFA is required then, i'm promoted for 'additional verification' and the notification i sent to my phone. But I cant replicate that when using PowerShell
CassidyKevinJOIT-5987 20 Reputation points

2025-09-05T19:56:53.7133333+00:00

The script used to work flawlessly for months until about two weeks ago. I am trying to find out what changed. Conditional Access Policies or more likely - PIM role activation requirement. I can see that MFA is needed to activate my role. I just cant seem to make that happen in PowerShell. PowerShell says we don't cause MFA prompting, EntraID does .. which is correct. But in this case, EntraID is requiring MFA and its not prompting me for it during sign in when using PowerShell

1 answer

Your answer

Andy David - MVP 160.4K Reputation points MVP Volunteer Moderator

2025-09-05T19:08:14.1066667+00:00

Is that the same device for MFA registered with your account? in other words, is the MFA prompt going to another phone? Does it work for other apps? Did it ever work for this?
Raja Pothuraju 47,840 Reputation points Microsoft Employee Moderator

2025-09-05T19:14:12.0966667+00:00

Hello CassidyKevinJOIT-5987,

Are you running these commands in PowerShell?

It looks like there is an active session already running in your PowerShell window, which is why it didn’t prompt you for Username + Password + MFA.

To resolve this, try running:

Disconnect-MgGraph

Once disconnected, run:

Connect-MgGraph

and check if this prompts you for MFA and allows you to sign in successfully.
CassidyKevinJOIT-5987 20 Reputation points

2025-09-05T19:43:51.9+00:00

I do call Disconnect-MgGraph at the very start of the script or session.
CassidyKevinJOIT-5987 20 Reputation points

2025-09-05T19:51:33.85+00:00

The account's Authentication methods has Microsoft Authenticator as the only usable auth method and Phone App Notification as the system preferred MFA method. However, I never received prompting on the phone. Note: I have no issues using Azure portal / EntraID to activate the PIM role. When MFA is required then, i'm promoted for 'additional verification' and the notification i sent to my phone. But I cant replicate that when using PowerShell
CassidyKevinJOIT-5987 20 Reputation points

2025-09-05T19:56:53.7133333+00:00

The script used to work flawlessly for months until about two weeks ago. I am trying to find out what changed. Conditional Access Policies or more likely - PIM role activation requirement. I can see that MFA is needed to activate my role. I just cant seem to make that happen in PowerShell. PowerShell says we don't cause MFA prompting, EntraID does .. which is correct. But in this case, EntraID is requiring MFA and its not prompting me for it during sign in when using PowerShell

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

3 deleted comments

Comments have been turned off. Learn more