Cannot assign an IAM role via PowerShell - azure

Question

The main problem is, that I can assign IAM role using the Azure portal, but got an error when trying the same via PowerShell.
This is the result of a portal action:
And I receive following error when I try to do the same via PowerShell:
> New-AzureRmRoleAssignment -ObjectId "d585d0b6-eb2b-4d7c-99b4-7c357219f78d" -RoleDefinitionName "Reader" -ResourceName "datalaketestmh" -ResourceType "Microsoft.DataLakeStore/accounts" -ResourceGroupName "My-Test-Resource-Group"
New-AzureRmRoleAssignment : Principal d585d0b6eb2b4d7c99b47c357219f78d does not exist in the directory 3596192b-fdf5-4e2c-a6fa-acb706c963d8.
At line:1 char:1
+ New-AzureRmRoleAssignment -ObjectId "d585d0b6-eb2b-4d7c-99b4-7c357219 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzureRmRoleAssignment], CloudException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Resources.NewAzureRoleAssignmentCommand
Any ideas where to look for the error?

Answer 1

Please use this script to get user ID:
$a = Get-AzureRmADUser | ?{ $_.UserPrincipalName -eq 'username#xxxx.onmicrosoft.com' } | select id
$userid = $a.id.Guid
Then use $userid to assign the role:
New-AzureRmRoleAssignment -ObjectId $userid -RoleDefinitionName "Reader" -ResourceName "datalaketestmh" -ResourceType "Microsoft.DataLakeStore/accounts" -ResourceGroupName "My-Test-Resource-Group"
By the way, please check your Azure PowerShell version, my Azure powershell version is 5.1.1, that script works for me:
PS C:\Users\jason> Get-Module -ListAvailable -Name Azure -Refresh
Directory: C:\Program Files (x86)\Microsoft SDKs\Azure\PowerShell\ServiceManagement
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 5.1.1 Azure {Get-AzureAutomationCertificate, Get-AzureAutomationConnection, New-AzureAutomationConnection, Remove-AzureAutomationConnection...}
Also you can use SignInName inside of ObjectId, like this:
New-AzureRmRoleAssignment -SignInName john.doe#contoso.com -RoleDefinitionName Owner -Scope "/subscriptions/86f81fc3-b00f-48cd-8218-3879f51ff362/resourcegroups/rg1/providers/Microsoft.Web/sites/site1"
More information about command New-AzureRmRoleAssignment, please refer to this article.
Hope this helps.