Azure Policy: check subscription role assignments

Question

Hi everyone

We have different types of users in our Azure AD. Only a certain subset of them are allowed to administer Azure resources. Those all start with "ACO" or "ACA".

We now wish to create an Azure Policy that checks whether only such users have been assigned any roles on subscription level. Any account without "ACO" or "ACA" at the start of their name should trigger an audit.

To write such a policy, I checked the available aliases in Microsoft.Authorization. Unfortunately, one can only query "Principal ID" and "Principal Type", but not "Principal Name" - which is the field I would need.

Is there any other way to write a policy that achieves what I wish to do?

Thanks,

Tobias

Answer 1

Hi Tobias,

Unfortunately, this cannot be achieved through Azure policy as "Principal Name" property of Role assignment is not returned in response payload by the GET/LIST REST API for Role Assignment. Neither it is passed into the request payload while creating Role Assignment

https://learn.microsoft.com/en-us/rest/api/authorization/role-assignments?view=rest-authorization-2022-04-01

Azure Policy depends on these REST API request/response payloads to AUDIT and DENY .