New-AzRoleAssignment

Module:

Az.Resources Module

Assigns the specified RBAC role to the specified principal, at the specified scope.

The cmdlet may call below Microsoft Graph API according to input parameters:

• GET /users/{id}
• GET /servicePrincipals/{id}
• GET /groups/{id}
• GET /directoryObjects/{id}

Please notice that this cmdlet will mark ObjectType as Unknown in output if the object of role assignment is not found or current account has insufficient privileges to get object type.

New-AzRoleAssignment
 -ObjectId <String>
 -RoleDefinitionName <String>
 [-Scope <String>]
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -ObjectId <String>
 -ResourceGroupName <String>
 -RoleDefinitionName <String>
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -ObjectId <String>
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 -RoleDefinitionName <String>
 [-ParentResource <String>]
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -ObjectId <String>
 -Scope <String>
 -RoleDefinitionId <Guid>
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -SignInName <String>
 -ResourceGroupName <String>
 -RoleDefinitionName <String>
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -SignInName <String>
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 -RoleDefinitionName <String>
 [-ParentResource <String>]
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -SignInName <String>
 -RoleDefinitionName <String>
 [-Scope <String>]
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -ApplicationId <String>
 -ResourceGroupName <String>
 -RoleDefinitionName <String>
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -ApplicationId <String>
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 -RoleDefinitionName <String>
 [-ParentResource <String>]
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -ApplicationId <String>
 -RoleDefinitionName <String>
 [-Scope <String>]
 [-Description <String>]
 [-Condition <String>]
 [-ConditionVersion <String>]
 [-ObjectType <String>]
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

New-AzRoleAssignment
 -InputFile <String>
 [-AllowDelegation]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Use the New-AzRoleAssignment command to grant access. Access is granted by assigning the appropriate RBAC role to them at the right scope. To grant access to the entire subscription, assign a role at the subscription scope. To grant access to a specific resource group within a subscription, assign a role at the resource group scope. The subject of the assignment must be specified. To specify a user, use SignInName or Microsoft Entra ObjectId parameters. To specify a security group, use Microsoft Entra ObjectId parameter. And to specify a Microsoft Entra application, use ApplicationId or ObjectId parameters. The role that is being assigned must be specified using the RoleDefinitionName parameter. The scope at which access is being granted may be specified. It defaults to the selected subscription. The scope of the assignment can be specified using one of the following parameter combinations a. Scope - This is the fully qualified scope starting with /subscriptions/<subscriptionId> b. ResourceGroupName - to grant access to the specified resource group. c. ResourceName, ResourceType, ResourceGroupName and (optionally) ParentResource - to specify a particular resource within a resource group to grant access to.

New-AzRoleAssignment -ResourceGroupName rg1 -SignInName allen.young@live.com -RoleDefinitionName Reader -AllowDelegation

Grant Reader role access to a user at a resource group scope with the Role Assignment being available for delegation

Get-AzADGroup -SearchString "Christine Koch Team"

 DisplayName Type Id
 ----------- ---- --------
 Christine Koch Team 2f9d4375-cbf1-48e8-83c9-2a0be4cb33fb

New-AzRoleAssignment -ObjectId 2f9d4375-cbf1-48e8-83c9-2a0be4cb33fb -RoleDefinitionName Contributor -ResourceGroupName rg1

Grant access to a security group

New-AzRoleAssignment -SignInName john.doe@contoso.com -RoleDefinitionName Owner -Scope "/subscriptions/00001111-aaaa-2222-bbbb-3333cccc4444/resourcegroups/rg1/providers/Microsoft.Web/sites/site1"

Grant access to a user at a resource (website)

New-AzRoleAssignment -ObjectId 00001111-aaaa-2222-bbbb-3333cccc4444 -RoleDefinitionName "Virtual Machine Contributor" -ResourceName Devices-Engineering-ProjectRND -ResourceType Microsoft.Network/virtualNetworks/subnets -ParentResource virtualNetworks/VNET-EASTUS-01 -ResourceGroupName Network

Grant access to a group at a nested resource (subnet)

$servicePrincipal = New-AzADServicePrincipal -DisplayName "testServiceprincipal"
New-AzRoleAssignment -RoleDefinitionName "Reader" -ApplicationId $servicePrincipal.ApplicationId

Grant reader access to a service principal

$Condition = '(
 (
 !(ActionMatches{''Microsoft.Authorization/roleAssignments/write''})
 )
 OR
 (
 @Request[Microsoft.Authorization/roleAssignments:PrincipalType] StringEqualsIgnoreCase ''ServicePrincipal''
 )
)
AND
(
 (
 !(ActionMatches{''Microsoft.Authorization/roleAssignments/delete''})
 )
 OR
 (
 @Resource[Microsoft.Authorization/roleAssignments:PrincipalType] StringEqualsIgnoreCase ''ServicePrincipal''
 )
)'

$DelegationParams = @{
 AllowDelegation = $true
 Condition = $Condition
 Scope = "/subscriptions/11112222-bbbb-3333-cccc-4444dddd5555"
 RoleDefinitionName = 'User Access Administrator'
 ObjectId = "00001111-aaaa-2222-bbbb-3333cccc4444"
}

New-AzRoleAssignment @DelegationParams

Grant User Access Administrator over an azure subscription with constrained delegation.
The constrained delegation will only allow that the delegated user/service principal/group may only create/delete/update new role assignments for a service principal and any roles.

$Condition = '(
 (
 !(ActionMatches{''Microsoft.Authorization/roleAssignments/write''})
 )
 OR
 (
 @Request[Microsoft.Authorization/roleAssignments:PrincipalType] StringEqualsIgnoreCase ''ServicePrincipal''
 AND
 NOT @Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {8e3af657-a8ff-443c-a75c-2fe8c4bcb635,18d7d88d-d35e-4fb5-a5c3-7773c20a72d9}
 )
)
AND
(
 (
 !(ActionMatches{''Microsoft.Authorization/roleAssignments/delete''})
 )
 OR
 (
 @Resource[Microsoft.Authorization/roleAssignments:PrincipalType] StringEqualsIgnoreCase ''ServicePrincipal''
 AND
 NOT @Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {8e3af657-a8ff-443c-a75c-2fe8c4bcb635,18d7d88d-d35e-4fb5-a5c3-7773c20a72d9}
 )
)'

$DelegationParams = @{
 AllowDelegation = $true
 Condition = $Condition
 Scope = "/subscriptions/11112222-bbbb-3333-cccc-4444dddd5555"
 RoleDefinitionName = 'User Access Administrator'
 ObjectId = "00001111-aaaa-2222-bbbb-3333cccc4444"
}

New-AzRoleAssignment @DelegationParams

Grant User Access Administrator over an azure subscription with constrained delegation.
The constrained delegation will only allow that the delegated user/service principal/group may only create/delete/update new role assignments for a service principal, excluding the Owner and User Access Administrator role.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Learn more about role assignment delegation - https://learn.microsoft.com/en-us/azure/role-based-access-control/delegate-role-assignments-portal?tabs=template
Keywords: azure, azurerm, arm, resource, management, manager, resource, group, template, deployment