{"id":1034,"date":"2020-04-27T08:00:42","date_gmt":"2020-04-27T14:00:42","guid":{"rendered":"https:\/\/practicalpowershell.com\/?p=1034"},"modified":"2020-04-18T15:54:56","modified_gmt":"2020-04-18T21:54:56","slug":"cmdlet-powershell-permissions-fix-for-scc","status":"publish","type":"post","link":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/","title":{"rendered":"Cmdlet PowerShell Permissions – ‘Fix’ for SCC"},"content":{"rendered":"

For a while now I have had issues with gathering permissions that are required to run cmdlets in the Security and Compliance Center. Basically any query that is made ends up with a Watson error. However, I may have found a workaround. It is convoluted as it requires another connection to another PowerShell module in Office 365 (in my test case, Exchange Online). Here is my test methodology.

\nConnection to the SCC<\/i>

\nOnce we have a PowerShell session connected to the Security and Compliance Center, we can attempt to get permissions using this method:
\n[sourcecode language=”powershell”]
\nGet-ManagementRole -Cmdlet <name of cmdlet to check>
\n[\/sourcecode]
\nSome sample test values (error messages received):
\n[sourcecode language=”powershell”]
\nGet-ManagementRole -Cmdlet Add-ComplianceCaseMember
\n[\/sourcecode]
\n\"\"<\/a>
\nTry one more cmdlet:
\n[sourcecode language=”powershell”]
\nGet-ManagementRole -Cmdlet Remove-ComplianceSecurityFilter
\n[\/sourcecode]
\nAnd:
\n\"\"<\/a>
\nWhat is the fix or workaround? Logging into Exchange Online PowerShell …

\nOnce connected, we can query the permissions. One note is that this is not 100% full proof. For example, the Remove-ComplianceSecurityFilter cmdlet, when queried, shows no Role Group Members. <\/p>\n

We should validate that the cmdlets are still of the correct module as we now have a second module in place and we want to validate that the cmdlets referenced are from the SCC PowerShell and not ExO? We would query a list of Security and Compliance Center cmdlets via the ‘Source’ of the cmdlet. What is the source? It is the module a cmdlet is a part of. For example. When we connect to Exchange Online or the Security and Compliance Center, we see a module name listed:

\nExchange Online Example:

\n\"\"<\/a>
\nSecurity and Compliance Center Example:

\n\"\"<\/a>
\nKeep in mind that this name will change every time you connect to any workload in Office 365 via PowerShell. In order to validate we have the right cmdlet, let’s get a list of all SCC cmdlets:
\n[sourcecode language=”powershell”]
\n$Commands = Get-command | Where {$_.Source -eq 'tmp_bo0pq1tq.yyj'}
\n[\/sourcecode]
\nThis will pull all those cmdlets and store them in the $Commands variable. We can then loop through that and check each cmdlet for permissions:
\n[sourcecode language=”powershell”]
\nForeach ($Command in $Commands) {
\n\t$Name = $Command.Name
\n\tWrite-Host $Name -ForegroundColor Magenta
\n\tGet-Manag,br.ementRole -Cmdlet $Name;Write-Host ''
\n}
\n[\/sourcecode]
\nNow we get output like this:

\n\"\"<\/a>
\nNotice that this is still not ideal. We are not getting permissions for all cmdlets. You should be able to verify this in your tenant. I have been able to reproduce this in two different production tenants. Now, if we want a good reference test, we can look to perform the same actions for Exchange cmdlets.
\n[sourcecode language=”powershell”]
\n$Module = 'tmp_5irlwytv.yab'
\n$Commands = Get-command | Where {$_.Source -eq $Module}
\nForeach ($Command in $Commands) {
\n\t$Name = $Command.Name
\n\tWrite-Host $Name -ForegroundColor Magenta
\n\tGet-ManagementRole -Cmdlet $Name;Write-Host ''
\n}
\n[\/sourcecode]
\nWhat do we see? [HINT: Better results!]:
\n\"\"<\/a>
\nSo what does this mean? PowerShell RBAC must be having issues in the SCC. If you can, test this in your tenant and post your results here. Would like some more live data on this.<\/p>\n","protected":false},"excerpt":{"rendered":"

For a while now I have had issues with gathering permissions that are required to run cmdlets in the Security and Compliance Center. Basically any query that is made ends up with a Watson error. However, I may have found a workaround. It is convoluted as it requires another connection to another PowerShell module in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":[],"rop_publish_now_history":[],"rop_publish_now_status":"pending","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[23,28,22,27],"tags":[],"class_list":["post-1034","post","type-post","status-publish","format-standard","hentry","category-7-0","category-get-help","category-powershell","category-security-and-compliance-center"],"yoast_head":"\nCmdlet PowerShell Permissions - 'Fix' for SCC - Practical PowerShell<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cmdlet PowerShell Permissions - 'Fix' for SCC - Practical PowerShell\" \/>\n<meta property=\"og:description\" content=\"For a while now I have had issues with gathering permissions that are required to run cmdlets in the Security and Compliance Center. Basically any query that is made ends up with a Watson error. However, I may have found a workaround. It is convoluted as it requires another connection to another PowerShell module in […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/\" \/>\n<meta property=\"og:site_name\" content=\"Practical PowerShell\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-27T14:00:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/practicalpowershell.com\/wp-content\/uploads\/2020\/04\/2020-04-27-SCC-Help-01.jpg\" \/>\n<meta name=\"author\" content=\"damian\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"damian\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/\"},\"author\":{\"name\":\"damian\",\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/#\\\/schema\\\/person\\\/4d0733c81966e744aabbb49f56d64deb\"},\"headline\":\"Cmdlet PowerShell Permissions – ‘Fix’ for SCC\",\"datePublished\":\"2020-04-27T14:00:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/\"},\"wordCount\":505,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/#\\\/schema\\\/person\\\/4d0733c81966e744aabbb49f56d64deb\"},\"image\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/practicalpowershell.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/2020-04-27-SCC-Help-01.jpg\",\"articleSection\":[\"7.0\",\"Get-Help\",\"PowerShell\",\"Security and Compliance Center\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/\",\"url\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/\",\"name\":\"Cmdlet PowerShell Permissions - 'Fix' for SCC - Practical PowerShell\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/practicalpowershell.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/2020-04-27-SCC-Help-01.jpg\",\"datePublished\":\"2020-04-27T14:00:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/practicalpowershell.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/2020-04-27-SCC-Help-01.jpg?fit=800%2C207&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/practicalpowershell.com\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/2020-04-27-SCC-Help-01.jpg?fit=800%2C207&ssl=1\",\"width\":800,\"height\":207},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/cmdlet-powershell-permissions-fix-for-scc\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/practicalpowershell.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cmdlet PowerShell Permissions – ‘Fix’ for SCC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/#website\",\"url\":\"https:\\\/\\\/practicalpowershell.com\\\/\",\"name\":\"Practical PowerShell\",\"description\":\"PowerShell books written by experts\",\"publisher\":{\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/#\\\/schema\\\/person\\\/4d0733c81966e744aabbb49f56d64deb\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/practicalpowershell.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/practicalpowershell.com\\\/#\\\/schema\\\/person\\\/4d0733c81966e744aabbb49f56d64deb\",\"name\":\"damian\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g\",\"caption\":\"damian\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cmdlet PowerShell Permissions - 'Fix' for SCC - Practical PowerShell","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/","og_locale":"en_US","og_type":"article","og_title":"Cmdlet PowerShell Permissions - 'Fix' for SCC - Practical PowerShell","og_description":"For a while now I have had issues with gathering permissions that are required to run cmdlets in the Security and Compliance Center. Basically any query that is made ends up with a Watson error. However, I may have found a workaround. It is convoluted as it requires another connection to another PowerShell module in […]","og_url":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/","og_site_name":"Practical PowerShell","article_published_time":"2020-04-27T14:00:42+00:00","og_image":[{"url":"https:\/\/practicalpowershell.com\/wp-content\/uploads\/2020\/04\/2020-04-27-SCC-Help-01.jpg","type":"","width":"","height":""}],"author":"damian","twitter_card":"summary_large_image","twitter_misc":{"Written by":"damian","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#article","isPartOf":{"@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/"},"author":{"name":"damian","@id":"https:\/\/practicalpowershell.com\/#\/schema\/person\/4d0733c81966e744aabbb49f56d64deb"},"headline":"Cmdlet PowerShell Permissions – ‘Fix’ for SCC","datePublished":"2020-04-27T14:00:42+00:00","mainEntityOfPage":{"@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/"},"wordCount":505,"commentCount":0,"publisher":{"@id":"https:\/\/practicalpowershell.com\/#\/schema\/person\/4d0733c81966e744aabbb49f56d64deb"},"image":{"@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#primaryimage"},"thumbnailUrl":"https:\/\/practicalpowershell.com\/wp-content\/uploads\/2020\/04\/2020-04-27-SCC-Help-01.jpg","articleSection":["7.0","Get-Help","PowerShell","Security and Compliance Center"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/","url":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/","name":"Cmdlet PowerShell Permissions - 'Fix' for SCC - Practical PowerShell","isPartOf":{"@id":"https:\/\/practicalpowershell.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#primaryimage"},"image":{"@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#primaryimage"},"thumbnailUrl":"https:\/\/practicalpowershell.com\/wp-content\/uploads\/2020\/04\/2020-04-27-SCC-Help-01.jpg","datePublished":"2020-04-27T14:00:42+00:00","breadcrumb":{"@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#primaryimage","url":"https:\/\/i0.wp.com\/practicalpowershell.com\/wp-content\/uploads\/2020\/04\/2020-04-27-SCC-Help-01.jpg?fit=800%2C207&ssl=1","contentUrl":"https:\/\/i0.wp.com\/practicalpowershell.com\/wp-content\/uploads\/2020\/04\/2020-04-27-SCC-Help-01.jpg?fit=800%2C207&ssl=1","width":800,"height":207},{"@type":"BreadcrumbList","@id":"https:\/\/practicalpowershell.com\/cmdlet-powershell-permissions-fix-for-scc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/practicalpowershell.com\/"},{"@type":"ListItem","position":2,"name":"Cmdlet PowerShell Permissions – ‘Fix’ for SCC"}]},{"@type":"WebSite","@id":"https:\/\/practicalpowershell.com\/#website","url":"https:\/\/practicalpowershell.com\/","name":"Practical PowerShell","description":"PowerShell books written by experts","publisher":{"@id":"https:\/\/practicalpowershell.com\/#\/schema\/person\/4d0733c81966e744aabbb49f56d64deb"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/practicalpowershell.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/practicalpowershell.com\/#\/schema\/person\/4d0733c81966e744aabbb49f56d64deb","name":"damian","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g","caption":"damian"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/d5a8cc64a5aa27558a897b108e3be1a89859511a3fd26176dac292f26e7a4ae4?s=96&d=mm&r=g"}}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/posts\/1034","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/comments?post=1034"}],"version-history":[{"count":1,"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/posts\/1034\/revisions"}],"predecessor-version":[{"id":1043,"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/posts\/1034\/revisions\/1043"}],"wp:attachment":[{"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/media?parent=1034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/categories?post=1034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/practicalpowershell.com\/wp-json\/wp\/v2\/tags?post=1034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}