Get-AzRoleAssignment -SignInName "XXX" is not filtering the RoleAssignments of the Resource Level via PowerShell

Question

Hi Guys,

Currently i am working on by automate the Azure Role Assignments using PowerShell script. When i use Get-AzRoleAssignment -SignInName "XXX"- i can get the details for some of the users. However, the same command won't return any data for certain users. I have cross verified that user XXXX was assigned to the Resource KeyVault with Reader Permission (Direct assignment).

My Requirement - if user give any user id then it will list out all the direct and InDirect assignments on the tenant like Managementgroup, subscription, ResourceGroup and Resource level.

Assignment.PNG

Answer 1

Hello there,

Check if you can get the information using the REST API. To list role assignments (list access), you can use one of the Role Assignments - List REST APIs. To refine your results, you specify a scope and an optional filter. To call the API, you must have access to the Microsoft.Authorization/roleAssignments/read operation at the specified scope. All built-in roles are granted access to this operation.

Use RBAC to manage access with the REST API https://learn.microsoft.com/en-us/rest/api/authorization/role-assignment-rest-sample

Also note 'New-AzRoleAssignment' PowerShell cmdlet is required to have 'Az.Resources' module. Refer to the following:

https://docs.microsoft.com/en-us/powershell/module/az.resources/new-azroleassignment?view=azps-4.3.0

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–