New-SafeguardAccessRequest fails finding the same account multiple times

[holger-weihe]

Using safeguard-ps version 7.2.96694 the cmdlet New-SafeguardAccessRequest fails with

PS C:\Users\Administrator.ONEIDENTITY> New-SafeguardAccessRequest

cmdlet New-SafeguardAccessRequest at command pipeline position 1
Supply values for the following parameters:
AssetToUse: portal.azure.com
AccessRequestType: Password
AccountToUse: henriettam@pamdorasbox.onmicrosoft.com
Exception: Found 2 requestable accounts matching 'henriettam@pamdorasbox.onmicrosoft.com'

when i check with "Find-SafeguardRequestableAccounts" i get

PS C:\Users\Administrator.ONEIDENTITY> Find-SafeguardRequestableAccount

cmdlet Find-SafeguardRequestableAccount at command pipeline position 1
Supply values for the following parameters:
SearchString: henriettam

AssetId : 125
AssetName : portal.azure.com
NetworkAddress :
PlatformDisplayName : Azure AD 1.0
AccountId : 274
AccountDomainName :
AccountName : HenriettaM@pamdorasbox.onmicrosoft.com
AccessRequestType : Password

AssetId : 125
AssetName : portal.azure.com
NetworkAddress :
PlatformDisplayName : Azure AD 1.0
AccountId : 274
AccountDomainName :
AccountName : HenriettaM@pamdorasbox.onmicrosoft.com
AccessRequestType : RemoteDesktopApplication

AssetId : 125
AssetName : portal.azure.com
NetworkAddress :
PlatformDisplayName : Azure AD 1.0
AccountId : 274
AccountDomainName :
AccountName : HenriettaM@pamdorasbox.onmicrosoft.com
AccessRequestType : Password

AssetId : 125
AssetName : portal.azure.com
NetworkAddress :
PlatformDisplayName : Azure AD 1.0
AccountId : 274
AccountDomainName :
AccountName : HenriettaM@pamdorasbox.onmicrosoft.com
AccessRequestType : RemoteDesktopApplication

which is correct for my environement because the account is enabled for password and RemoteDesktopApplication requests. But the output lists 4 matches but the command complains on 2 entries only.

When i modify the entitlement to remove the "RemoteDesktopApplication" from the account i will get

PS C:\Users\Administrator.ONEIDENTITY> Find-SafeguardRequestableAccount

cmdlet Find-SafeguardRequestableAccount at command pipeline position 1
Supply values for the following parameters:
SearchString: henriettam

AssetId : 125
AssetName : portal.azure.com
NetworkAddress :
PlatformDisplayName : Azure AD 1.0
AccountId : 274
AccountDomainName :
AccountName : HenriettaM@pamdorasbox.onmicrosoft.com
AccessRequestType : Password

AssetId : 125
AssetName : portal.azure.com
NetworkAddress :
PlatformDisplayName : Azure AD 1.0
AccountId : 274
AccountDomainName :
AccountName : HenriettaM@pamdorasbox.onmicrosoft.com
AccessRequestType : Password

and the "New-SafeguardAccessRequest" does not succeed because i got

PS C:\Users\Administrator.ONEIDENTITY> New-SafeguardAccessRequest

cmdlet New-SafeguardAccessRequest at command pipeline position 1
Supply values for the following parameters:
AssetToUse: portal.azure.com
AccessRequestType: Password
AccountToUse: henriettam@pamdorasbox.onmicrosoft.com
Exception: Found 2 requestable accounts matching 'henriettam@pamdorasbox.onmicrosoft.com'

So it looks like it is duplicating the entries found.

[petrsnd]

@holger-weihe There were some changes to this cmdlet to fix another issue that might have caused this problem. We will try to reproduce and get back to you.

[dukkse77]

I agree on the behavior, of finding multiple, even worse if you have multiple admin accounts (not to mention if you then have assets too)
Here is how I solved the problem

$accountName = 	Get-SafeguardRequestableAccount | where{$_.AccessRequestType -eq "Password" -and $_.AccountName -like "xxx*"} | select -first 1
$newRequest = New-SafeguardAccessRequest -Appliance $source -insecure -AccountToUse $accountName.AccountId -AssetToUse $accountAsset -AccessRequestType "Password" -ReasonComment "Whatever reason you want in the logs"

Hope this solves your problem until a better solution is provided for you

[azirish1998]

This is an issue for me as well. Problem seems to be in Resolve-safeguardRequestableAccountId. There is an explicit check for more than 1 account and it throws an exception. My workaround below

    if ($local:Accounts.Count -gt 1)

    {

        #throw "Found $($local:Accounts.Count) requestable accounts matching '$Account'"

        return $local:Accounts[0].Id

    }

    $local:Accounts.Id