Get-AzurePIMDirectoryRoles - The provider is missing

[rfcdejong]

Since 17 december our pipeline in Azure runs into this error. Something wrong with getting PIM DirectoryRoles. Perhaps something with missing a filter after reading this link https://learn.microsoft.com/en-us/answers/questions/2154953/how-to-fix-the-provider-is-missing-error

➡️
##[error]Invoke-MgGraphRequest : GET https://graph.microsoft.com/v1.0/policies/roleManagementPolicies//rules
HTTP/1.1 400 Bad Request
Transfer-Encoding: chunked
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 0fee1bb2-d2db-4339-bdff-a42a53e9358b
client-request-id: 1f7313fd-6772-454e-8667-ebcb38708079
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"West
Europe","Slice":"E","Ring":"5","ScaleUnit":"007","RoleInstance":"AM4PEPF0002BAD4"}}
Cache-Control: private
Date: Wed, 17 Dec 2025 02:07:29 GMT
Content-Type: application/json
{"error":{"code":"UnknownError","message":"{"errorCode":"MissingProvider","message":"The provider is missing.",
"instanceAnnotations":[]}","innerError":{"date":"2025-12-17T02:07:30","request-id":"0fee1bb2-d2db-4339-bdff-a42a53e93
58b","client-request-id":"1f7313fd-6772-454e-8667-ebcb38708079"}}}
At C:\Program Files\WindowsPowerShell\Modules\EntraExporter\3.0.1\command\Get-AzurePIMDirectoryRoles.ps1:97 char:21

• ... $response = Invoke-MgGraphRequest -Uri "v1.0/policies/roleManagementP ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (Method: GET, Re...ebcb38708079
    }:HttpRequestMessage) [Invoke-MgGraphRequest], HttpResponseException
  • FullyQualifiedErrorId : InvokeGraphHttpResponseException,Microsoft.Graph.PowerShell.Authentication.Cmdlets.Invok
    eMgGraphRequest
    ##[error]PowerShell exited with code '1'.

[mlewak]

I see the same problem with custom roles
it seems to me that in function Get-PIMDirectoryRoleAssignmentSetting
calling "v1.0/policies/roleManagementPolicyAssignments"
does not yield any results for such roles, hence the policyID is not available and cannot be used in subsequent calls causing the error

[nagarjunr]

I am seeing the same “MissingProvider” problem in EntraExporter 3.0.1 when exporting PIM Directory Roles.

Symptom

The module ends up calling:
GET https://graph.microsoft.com/v1.0/policies/roleManagementPolicies//rules

This returns:
400 BadRequest
errorCode: MissingProvider
message: "The provider is missing."

The export continues for other objects, but PIM directory role policy rules are not exported for the affected item(s).

Environment

• PowerShell: 7.x
• OS: macOS
• EntraExporter: 3.0.1 (installed from PSGallery)
• Auth: Microsoft Graph app-only (certificate) using Connect-MgGraph
• Tenant: Entra ID (single tenant). No custom role management policies (only built-in/default).

Why I think this is a bug in the module

The script does not guard against an empty/NULL policyId before building the rules URL. If policyId cannot be resolved for any reason, it should skip safely and log which role/policy was skipped, rather than issuing an invalid //rules request.

Graph docs expect a valid policy id for /policies/roleManagementPolicies/{id}/rules, so //rules is always invalid.

Workaround I used

I patched Get-AzurePIMDirectoryRoles.ps1 to wrap the rules call with a guard:

• If policyId is empty: set response to @{ value = @() } and continue
• Else: call /policies/roleManagementPolicies/{policyId}/rules

This avoids the invalid request and lets the export complete cleanly.

Ask

Could the module add a guard for empty policyId and include logging of the roleDefinitionId/roleName when this occurs?

[rfcdejong]

I am seeing the same “MissingProvider” problem in EntraExporter 3.0.1 when exporting PIM Directory Roles.

Symptom

The module ends up calling: GET https://graph.microsoft.com/v1.0/policies/roleManagementPolicies//rules

This returns: 400 BadRequest errorCode: MissingProvider message: "The provider is missing."

The export continues for other objects, but PIM directory role policy rules are not exported for the affected item(s).

Environment

• PowerShell: 7.x
• OS: macOS
• EntraExporter: 3.0.1 (installed from PSGallery)
• Auth: Microsoft Graph app-only (certificate) using Connect-MgGraph
• Tenant: Entra ID (single tenant). No custom role management policies (only built-in/default).

Why I think this is a bug in the module

The script does not guard against an empty/NULL policyId before building the rules URL. If policyId cannot be resolved for any reason, it should skip safely and log which role/policy was skipped, rather than issuing an invalid //rules request.

Graph docs expect a valid policy id for /policies/roleManagementPolicies/{id}/rules, so //rules is always invalid.

Workaround I used

I patched Get-AzurePIMDirectoryRoles.ps1 to wrap the rules call with a guard:

• If policyId is empty: set response to @{ value = @() } and continue
• Else: call /policies/roleManagementPolicies/{policyId}/rules

This avoids the invalid request and lets the export complete cleanly.

Ask

Could the module add a guard for empty policyId and include logging of the roleDefinitionId/roleName when this occurs?

sounds like this should be a PR so it can be merged into main

[rfcdejong]

Seems it is a custom role that is based on scopeType 'Directory' and not 'DirectoryRole'. So a fix wouldn't be to ignore the policyId, but to remove the filter for 'DirectoryRole' or iclude 'Directory'

https://graph.microsoft.com/v1.0/policies/roleManagementPolicyAssignments?$filter=scopeType eq
'DirectoryRole' and roleDefinitionId eq 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' and scopeId eq '/' with 0-byte payload