How to retrieve role condition from ARM API

Welcome to Microsoft Q&A

Hello @Neel Manthani I hope you are doing well,

The reason you are not seeing the condition field in the API response is due to the specific API version you are targeting.

While API version 2022-04-01 was the milestone release that brought Attribute-Based Access Control (ABAC) conditions to General Availability for Role Assignments, the schema for Role Definitions did not immediately expose the corresponding built-in condition properties.

According to the Azure REST API changelog, the condition and conditionVersion fields were not added to the Microsoft.Authorization/roleDefinitions schema until the 2022-05-01-preview API version. Resource Graph Explorer uses newer/internal API versions by default, which is why you can see the field there but not in your Terraform outputs.

How to resolve this: Update your azapi Terraform configuration to use the newer API version:

Change your type string to Microsoft.Authorization/roleDefinitions@2022-05-01-preview (or a newer available version).

Note that the condition field is not located at the root of properties. Because a role definition can have multiple permission sets, the condition is nested inside the permissions array.

Once you update the API version, you will find the condition field in the retrieved JSON object at this path: properties.permissions[0].condition

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily.

Hi @Neel Manthani ,

When you call the ARM API for role definitions (Microsoft.Authorization/roleDefinitions@2022-04-01), the payload represents the definition of permissions (for example, actions, dataActions, etc.).

The RBAC condition (and related conditionVersion) is not a property of role definitions in ARM. It’s a property that exists only on role assignments (Microsoft.Authorization/roleAssignments), i.e., it’s evaluated as part of “who has which permissions, under what condition”.

So, even though you may see condition when using Resource Graph Explorer (because it can aggregate/compute RBAC view data), the raw roleDefinitions ARM objects won’t include condition.

If your goal is to retrieve the condition, you should query role assignments for the relevant scope(s) and filter for the role definition you care about. In other words:

• Use Microsoft.Authorization/roleAssignments to list role assignments
• Read the condition / conditionVersion fields from those role assignment objects return it. To access condition, you need to query roleAssignments instead.