Get-AzRoleDefinition

Module:

Az.Resources Module

Lists all Azure RBAC roles that are available for assignment.

Get-AzRoleDefinition
 [[-Name] <String>]
 [-Scope <String>]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleDefinition
 -Id <Guid>
 [-Scope <String>]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Get-AzRoleDefinition
 [-Scope <String>]
 [-Custom]
 [-SkipClientSideScopeValidation]
 [-DefaultProfile <IAzureContextContainer>]
 [<CommonParameters>]

Use the Get-AzRoleDefinition command with a particular role name to view its details. To inspect individual operations that a role grants access to, review the Permissions property of the role. Each permission entry contains Actions, NotActions, DataActions, NotDataActions, and optionally Condition and ConditionVersion properties. Roles with Attribute-Based Access Control (ABAC) conditions will have the Condition and ConditionVersion set on the appropriate permission entry.

Get-AzRoleDefinition -Name Reader

Retrieves the Reader role definition with all its permissions.

Get-AzRoleDefinition

Lists all Azure RBAC role definitions available in the current scope.

$roleDef = Get-AzRoleDefinition -Name "Virtual Machine Contributor"
$roleDef.Permissions[0].Actions

Retrieves the actions from the first permission entry of a role definition.

$roleDef = Get-AzRoleDefinition -Name "Key Vault Data Access Administrator"
foreach ($permission in $roleDef.Permissions) {
 Write-Host "Actions: $($permission.Actions -join ', ')"
 Write-Host "DataActions: $($permission.DataActions -join ', ')"
 if ($permission.Condition) {
 Write-Host "Condition: $($permission.Condition)"
 Write-Host "ConditionVersion: $($permission.ConditionVersion)"
 }
}

Iterates through all permission entries and displays actions and any ABAC conditions. Key Vault Data Access Administrator is a built-in role that carries a real ABAC condition on one of its permission entries, so the if ($permission.Condition) branch actually fires.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Keywords: azure, azurerm, arm, resource, management, manager, resource, group, template, deployment