Get-PPRBACRoleAssignment

Module:

Microsoft.PowerPlatform.EnterprisePolicies Module

Gets Power Platform role-based access control (RBAC) role assignments at a specified scope.

Syntax

TenantScope (Default)

Get-PPRBACRoleAssignment
    -TenantId <String>
    [-ClientId <String>]
    [-ExcludeParentScopes]
    [-NoExpandSecurityGroups]
    [-NoExpandEnvironmentGroups]
    [-ExcludeNestedScopes]
    [-PrincipalType <AuthorizationPrincipalType>]
    [-PrincipalObjectId <String>]
    [-Permission <String>]
    [-Endpoint <PPEndpoint>]
    [-ForceAuth]
    [<CommonParameters>]

EnvironmentScope

Get-PPRBACRoleAssignment
    -TenantId <String>
    -EnvironmentId <String>
    [-ClientId <String>]
    [-ExcludeParentScopes]
    [-NoExpandSecurityGroups]
    [-NoExpandEnvironmentGroups]
    [-ExcludeNestedScopes]
    [-PrincipalType <AuthorizationPrincipalType>]
    [-PrincipalObjectId <String>]
    [-Permission <String>]
    [-Endpoint <PPEndpoint>]
    [-ForceAuth]
    [<CommonParameters>]

Description

This cmdlet retrieves role assignments for Power Platform RBAC operations. The scope can be at the tenant or environment level.

If -ClientId isn't specified, the cmdlet uses the cached ClientId from a previous call to New-PPAuthorizationApplication or any Power Platform RBAC cmdlet that was given -ClientId explicitly. When -ClientId is provided, it's stored in the cache for future use.

By default, results include parent scopes, nested scopes, expanded security groups, and expanded environment groups. Use the corresponding switches to disable these behaviors.

Examples

EXAMPLE 1

Get-PPRBACRoleAssignment -ClientId "00000000-0000-0000-0000-000000000000" -TenantId "00000000-0000-0000-0000-000000000001"

Gets all role assignments at the tenant scope with all expansions enabled.

EXAMPLE 2

Get-PPRBACRoleAssignment -ClientId "00000000-0000-0000-0000-000000000000" -TenantId "00000000-0000-0000-0000-000000000001" -EnvironmentId "00000000-0000-0000-0000-000000000002"

Gets all role assignments at the environment scope with all expansions enabled.

EXAMPLE 3

Get-PPRBACRoleAssignment -ClientId "00000000-0000-0000-0000-000000000000" -TenantId "00000000-0000-0000-0000-000000000001" -EnvironmentId "00000000-0000-0000-0000-000000000002" -ExcludeParentScopes -NoExpandSecurityGroups

Gets role assignments at the environment scope, excluding parent scopes and without expanding security group memberships.

EXAMPLE 4

Get-PPRBACRoleAssignment -ClientId "00000000-0000-0000-0000-000000000000" -TenantId "00000000-0000-0000-0000-000000000001" -ExcludeNestedScopes -NoExpandEnvironmentGroups

Gets role assignments at the tenant scope, excluding nested scopes and without expanding environment group memberships.

EXAMPLE 5

Get-PPRBACRoleAssignment -ClientId "00000000-0000-0000-0000-000000000000" -TenantId "00000000-0000-0000-0000-000000000001" -PrincipalType User -PrincipalObjectId "00000000-0000-0000-0000-000000000005"

Gets role assignments for a specific user principal.

EXAMPLE 6

Get-PPRBACRoleAssignment -ClientId "00000000-0000-0000-0000-000000000000" -TenantId "00000000-0000-0000-0000-000000000001" -Permission "Read"

Gets role assignments filtered by a specific permission.

Parameters

-ClientId

The application (client) ID of the app registration

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Endpoint

The BAP endpoint to connect to

Parameter properties

Type:	PPEndpoint
Default value:	Prod
Accepted values:	unknown, tip1, tip2, prod, usgovhigh, dod, china
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-EnvironmentId

The environment ID for environment-scoped queries

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

EnvironmentScope

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ExcludeNestedScopes

Exclude role assignments from nested scopes

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ExcludeParentScopes

Exclude role assignments from parent scopes

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ForceAuth

Force re-authentication instead of reusing existing session

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-NoExpandEnvironmentGroups

Do not expand environment group memberships in the results

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-NoExpandSecurityGroups

Do not expand security group memberships in the results

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Permission

Filter by permission name

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PrincipalObjectId

Filter by principal object ID

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PrincipalType

Filter by principal type

Parameter properties

Type:	AuthorizationPrincipalType
Default value:	None
Accepted values:	User, Group, ApplicationUser
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TenantId

The Azure AD tenant ID

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Outputs

System.Management.Automation.PSCustomObject

Returns the role assignments from the API.