Get-AzRoleAssignment

Module:

Az.Resources Module

Lists Azure RBAC role assignments at the specified scope. By default it lists all role assignments in the selected Azure subscription. Use respective parameters to list assignments to a specific user, or to list assignments on a specific resource group or resource.

The cmdlet may call below Microsoft Graph API according to input parameters:

• GET /users/{id}
• GET /servicePrincipals/{id}
• GET /groups/{id}
• GET /directoryObjects/{id}
• POST /directoryObjects/getByIds

Please notice that this cmdlet will mark ObjectType as Unknown in output if the object of role assignment is not found or current account has insufficient privileges to get object type.

Get-AzRoleAssignment
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ObjectId <String>
 [-RoleDefinitionName <String>]
 [-ExpandPrincipalGroups]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ObjectId <String>
 -ResourceGroupName <String>
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ObjectId <String>
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 [-ParentResource <String>]
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ObjectId <String>
 -Scope <String>
 [-RoleDefinitionName <String>]
 [-AtScope]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -RoleDefinitionId <Guid>
 [-ObjectId <String>]
 [-Scope <String>]
 [-AtScope]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -SignInName <String>
 -ResourceGroupName <String>
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -SignInName <String>
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 [-ParentResource <String>]
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -SignInName <String>
 -Scope <String>
 [-RoleDefinitionName <String>]
 [-AtScope]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -SignInName <String>
 [-RoleDefinitionName <String>]
 [-ExpandPrincipalGroups]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ServicePrincipalName <String>
 -ResourceGroupName <String>
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ServicePrincipalName <String>
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 [-ParentResource <String>]
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ServicePrincipalName <String>
 -Scope <String>
 [-RoleDefinitionName <String>]
 [-AtScope]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ServicePrincipalName <String>
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ResourceGroupName <String>
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -ResourceGroupName <String>
 -ResourceName <String>
 -ResourceType <String>
 [-ParentResource <String>]
 [-RoleDefinitionName <String>]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleAssignment
 -Scope <String>
 [-RoleDefinitionName <String>]
 [-AtScope]
 [-IncludeClassicAdministrators]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Use the Get-AzRoleAssignment command to list all role assignments that are effective on a scope. Without any parameters, this command returns all the role assignments made under the subscription. This list can be filtered using filtering parameters for principal, role and scope. The subject of the assignment must be specified. To specify a user, use SignInName or Microsoft Entra ObjectId parameters. To specify a security group, use Microsoft Entra ObjectId parameter. And to specify a Microsoft Entra application, use ServicePrincipalName or ObjectId parameters. The role that is being assigned must be specified using the RoleDefinitionName parameter. The scope at which access is being granted may be specified. It defaults to the selected subscription. The scope of the assignment can be specified using one of the following parameter combinations a. Scope - This is the fully qualified scope starting with /subscriptions/<subscriptionId>. This will filter assignments that are effective at that particular scope i.e. all assignments at that scope and above. b. ResourceGroupName - Name of any resource group under the subscription. This will filter assignments effective at the specified resource group c. ResourceName, ResourceType, ResourceGroupName and (optionally) ParentResource - Identifies a particular resource under the subscription and will filter assignments effective at that resource scope. To determine what access a particular user has in the subscription, use the ExpandPrincipalGroups switch. This will list all roles assigned to the user, and to the groups that the user is member of. Use the IncludeClassicAdministrators switch to also display the subscription admins and co-admins.

Get-AzRoleAssignment

List all role assignments in the subscription

Get-AzRoleAssignment -ResourceGroupName testRG -SignInName john.doe@contoso.com

Gets all role assignments made to user john.doe@contoso.com, and the groups of which he is member, at the testRG scope or above.

Get-AzRoleAssignment -ServicePrincipalName "http://testapp1.com"

Gets all role assignments of the specified service principal

Get-AzRoleAssignment -Scope "/subscriptions/96231a05-34ce-4eb4-aa6a-70759cbb5e83/resourcegroups/rg1/providers/Microsoft.Web/sites/site1"

Gets role assignments at the 'site1' website scope.

$ApplicationObject = Get-AzADServicePrincipal -DisplayName 'ApplicationDisplayName'
Get-AzRoleAssignment -ServicePrincipalName $ApplicationObject.AppId

Gets role assignments for the specified Service Principal using Get-AzAdServicePrincipal.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Keywords: azure, azurerm, arm, resource, management, manager, resource, group, template, deployment