I need to export the list of user in Azure with their respective permissions on resources Groups and resources and need to export to excel files via powershell command.

Question

I need to export the list of user in Azure with their respective permissions on resources Groups and resources and need to export to excel files via powershell command.

Anji Babu Eluri 1

Hi Team,
I need to export the list of user in Azure with their respective permissions on resources Groups and resources and need to export to excel files via PowerShell command.
Please find the attachment of excel file for the formate.

Note: In my prod Env we have more than 250 Resource groups there. We would like to validate the users access on the Resource groups.

Regards
Anjibabu

4 answers

Your answer

Answer 1

James Hamil 27,211 Microsoft Employee Moderator

Hi @Anji Babu Eluri , would this document work for you? You can filter users and download them to a .csv. It's not exactly what you asked for but it may be an option to consider. If not please let me know and I can help you further.

If this answer helped you please mark it as "Verified" so other users may reference it.

Thank you,
James

Anji Babu Eluri 1 Reputation point

2021-12-10T03:44:49.807+00:00

@James Hamil ,

Thanks for your response.
In my environment we have more than 250 Resource groups are there. We are giving the permissions (ACL) to users on resources groups only ,not on subscription level.
Now we are doing auditing ,so we would like to know, what are the users are having access on which resource groups and what level of access(Owner, contributor or reader).The out put should be in excel format.
Can you please help me on this.

Regards
Anjibabu

Answer 2

Manu Philip 20,206 MVP Volunteer Moderator

I have prepared an az scripts as below:
Save the script as a ps1 file and run it in your az PS window.
Note that, your subscription should be connected already before running the script

Get-AzResourceGroup| foreach-object { $ResourceGroupName = $_.ResourceGroupName Get-AzRoleAssignment | Select-Object DisplayName,RoleAssignmentID,@{Name = "ResourceGroup Name"; Expression = { (Get-AzResourceGroup $ResourceGroupName).ResourceGroupName}} ,Scope,RoleDefinitionName,@{name="SubscriptionName";expression = {$Name}},ObjectType | Sort-Object DisplayName }-OutVariable azusers $azusers | Export-CSV UserList.csv -NoTypeInformation -Encoding UTF8

Manu Philip 20,206 Reputation points MVP Volunteer Moderator

2021-12-12T07:53:57.367+00:00

@Anji Babu Eluri , have you got a chance to check the script? If it works, mark it here so that others who is searching for the similar script can use it
surindersingh dhaliwal 86 Reputation points

2021-12-12T17:37:26.67+00:00
Hi @Manu Philip ,

Thanks for your reply but when i run the above script it gives below error. please note I am not expert in powershell. Please let me know if i am doing anything wrong.

PS C:\Windows\system32> Connect-AzAccount
Get-AzResourceGroup| foreach-object { $ResourceGroupName = $_.ResourceGroupName Get-AzRoleAssignment | Select-Object DisplayName,RoleAssignmentID,@{Name = "ResourceGroup Name"; Expression = { (Get-AzResourceGroup $ResourceGroupName).ResourceGroupName}} ,Scope,RoleDefinitionName,@{name="SubscriptionName";expression = {$Name}},ObjectType | Sort-Object DisplayName }-OutVariable azusers $azusers | Export-CSV UserList.csv -NoTypeInformation -Encoding UTF8

At line:2 char:81

... ResourceGroupName = $_.ResourceGroupName Get-AzRoleAssignment | Selec ...

~~~~~~~~~~~~~~~~~~~~
Unexpected token 'Get-AzRoleAssignment' in expression or statement.

CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException

FullyQualifiedErrorId : UnexpectedToken

Answer 3

Manu Philip 20,206 MVP Volunteer Moderator

I am providing more details to run the script as below:

Copy the script to a text file Get-AzResourceGroup| foreach-object { $ResourceGroupName = $_.ResourceGroupName Get-AzRoleAssignment | Select-Object DisplayName,RoleAssignmentID,@{Name = "ResourceGroup Name"; Expression = { (Get-AzResourceGroup $ResourceGroupName).ResourceGroupName}} ,Scope,RoleDefinitionName,@{name="SubscriptionName";expression = {$Name}},ObjectType | Sort-Object DisplayName }-OutVariable azusers $azusers | Export-CSV UserList.csv -NoTypeInformation -Encoding UTF8
Save as a ps1 file under any folder (example C:\script\azuser.ps1
Connect Azure account in PowerShell (az login)
Run the script (example PS C:\script> .\azuser.ps1
If it works well, the result will be saved in the same folder with name UserList.csv

Let me know if you are able to run it well

surindersingh dhaliwal 86 Reputation points

2021-12-18T18:36:24.177+00:00

Hi @Manu Philip

Thanks for your detail explanation here

Actually it works for me fine except subscription name column is blank.

I just want to know one more details like how to get the all azure AD users access
(Role definition) for each resources in subscription.

As in our environment, most of the users are in separate groups means we are not adding them individually in Role assignment for every RG.

So when i ran the above script it shows the Group name in Display column.

is there any way to fetch the report Azure AD user wise with their Role assignment for each resources

Like manish chavda has access of N number of Resource group with respective role assignment
surindersingh dhaliwal 86 Reputation points

2021-12-19T06:20:10.733+00:00

Like this kind of details so i can see all the users access over the subscription and RG's for all users without seeing group name
anji babu eluri 11 Reputation points

2021-12-21T07:16:08.897+00:00

@Manu Philip ,

Thanks for your help.
Sorry for the delayed response.
Script is working fine for me. There is no issue.
Once again thanks for your help.
Regards
Anjibabu
Manu Philip 20,206 Reputation points MVP Volunteer Moderator

2021-12-21T10:26:32.42+00:00

Glad to hear that the script helped you !

If the Answer is helpful, please click "Accept Answer" and upvote it. Others with similar requirement can find it too
minhaj muhammad khan 6 Reputation points

2022-05-30T18:03:55.347+00:00

Hi @Manu Philip ,

Hope you are doing great!

Can you tell me that how i can reun this script in azure automate bcz when i am running this in azure automate it not show me "Object type" and "displayname"

Answer 4

Sajid 1

Hi Manu,

Hope you doing well !

i am looking for a script where i can fetch the user IAM both subscription level and resource group level.
can you pls help on this .

Share via

I need to export the list of user in Azure with their respective permissions on resources Groups and resources and need to export to excel files via powershell command.

4 answers

Your answer