Get-AzDenyAssignment
列出指定範圍中的 Azure RBAC 拒絕指派。 根據預設，它會列出所選 Azure 訂用帳戶中的所有拒絕指派。 使用個別參數來列出特定用戶的拒絕指派，或列出特定資源群組或資源上的拒絕指派。
Cmdlet 可能會根據輸入參數呼叫下列 Microsoft Graph API：
- GET /directoryObjects/{id}
- POST /directoryObjects/getByIds
Syntax
Get-AzDenyAssignment
[-Scope <String>]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ObjectId <Guid>
[-ExpandPrincipalGroups]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ObjectId <Guid>
-ResourceGroupName <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ObjectId <Guid>
-ResourceGroupName <String>
-ResourceName <String>
-ResourceType <String>
[-ParentResource <String>]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ObjectId <Guid>
-Scope <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-SignInName <String>
-ResourceGroupName <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-SignInName <String>
-ResourceGroupName <String>
-ResourceName <String>
-ResourceType <String>
[-ParentResource <String>]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-SignInName <String>
-Scope <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-SignInName <String>
[-ExpandPrincipalGroups]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ServicePrincipalName <String>
-ResourceGroupName <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ServicePrincipalName <String>
-ResourceGroupName <String>
-ResourceName <String>
-ResourceType <String>
[-ParentResource <String>]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ServicePrincipalName <String>
-Scope <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ServicePrincipalName <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ResourceGroupName <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-ResourceGroupName <String>
-ResourceName <String>
-ResourceType <String>
[-ParentResource <String>]
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
-Scope <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
[-Scope <String>]
-Id <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Get-AzDenyAssignment
[-Scope <String>]
-DenyAssignmentName <String>
[-DefaultProfile <IAzureContextContainer>]
[<CommonParameters>] Description
使用 Get-AzDenyAssignment 命令來列出在範圍上生效的所有拒絕指派。 如果沒有任何參數，此命令會傳回訂用帳戶下所做的所有拒絕指派。 您可以使用主體篩選參數、拒絕指派名稱和範圍來篩選此清單。 若要指定使用者，請使用 SignInName 或 Microsoft Entra ObjectId 參數。 若要指定安全組，請使用 Microsoft Entra ObjectId 參數。 若要指定 Microsoft Entra 應用程式，請使用 ServicePrincipalName 或 ObjectId 參數。 可以指定拒絕存取的範圍。 默認為選取的訂用帳戶。 您可以使用下列其中一個參數組合來指定拒絕指派的範圍。 範圍 - 這是以 /subscriptions/<subscriptionId> 開頭的完整範圍。 這會篩選在特定範圍生效的拒絕指派，亦即該範圍和更新版本的所有拒絕指派。 b. ResourceGroupName - 訂用帳戶下任何資源群組的名稱。 這會篩選指定資源群組的有效指派，也就是該範圍和更新版本的所有拒絕指派。 c. ResourceName、ResourceType、ResourceGroupName 和 （選擇性地） ParentResource - 識別訂用帳戶底下的特定資源，並將篩選出在該資源範圍內有效的拒絕指派。 若要判斷訂用帳戶中特定用戶拒絕的存取權，請使用 ExpandPrincipalGroups 參數。 這會列出指派給使用者的所有拒絕指派，以及指派給用戶所屬的群組。
範例
範例 1
列出訂用帳戶中的所有拒絕指派
Get-AzDenyAssignment
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/denyAssignments/22704996-fbd0-4ab1-8625-722d897825d2
DenyAssignmentName : Test deny assignment 1
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f
DoNotApplyToChildScopes : False
Principals : {
DisplayName: All Principals
ObjectType: SystemDefined
ObjectId: 00000000-0000-0000-0000-000000000000
}
ExcludePrincipals : {
DisplayName: testuser
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
}
IsSystemProtected : True
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName : Test deny assignment 2
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals : {
DisplayName: testuser
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
,
DisplayName: PowershellTestingApp
ObjectType: ServicePrincipal
ObjectId: f2dc21ac-702a-4bde-a4ce-146edf751d81
}
ExcludePrincipals : {}
IsSystemProtected : True範例 2
取得在範圍testRG和更新版本對使用者 john.doe@contoso.com 所做的所有拒絕指派。
Get-AzDenyAssignment -ResourceGroupName testRG -SignInName john.doe@contoso.com
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/denyAssignments/22704996-fbd0-4ab1-8625-722d897825d2
DenyAssignmentName : Test deny assignment 1
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f
DoNotApplyToChildScopes : False
Principals : {
DisplayName: john.doe
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
}
ExcludePrincipals : {}
IsSystemProtected : True
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName : Test deny assignment
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals : {
DisplayName: john.doe
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
,
DisplayName: PowershellTestingApp
ObjectType: ServicePrincipal
ObjectId: f2dc21ac-702a-4bde-a4ce-146edf751d81
}
ExcludePrincipals : {}
IsSystemProtected : True範例 3
取得指定服務主體的所有拒絕指派
Get-AzDenyAssignment -ServicePrincipalName 'http://testapp1.com'
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName : Test deny assignment 1
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals : {
DisplayName: TestApp
ObjectType: ServicePrincipal
ObjectId: f2dc21ac-702a-4bde-a4ce-146edf751d81
}
ExcludePrincipals : {}
IsSystemProtected : True
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1/providers/Microsoft.Authorization/denyAssignments/94e3d9da-3700-4113-aab4-15f6c173d794
DenyAssignmentName : Test deny assignment 2
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1
DoNotApplyToChildScopes : False
Principals : {
DisplayName: testuser
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
,
DisplayName: TestApp
ObjectType: ServicePrincipal
ObjectId: f2dc21ac-702a-4bde-a4ce-146edf751d81
}
ExcludePrincipals : {}
IsSystemProtected : True範例 4
取得 『site1』 網站範圍的拒絕指派。
Get-AzDenyAssignment -Scope '/subscriptions/96231a05-34ce-4eb4-aa6a-70759cbb5e83/resourcegroups/testRG/providers/Microsoft.Web/sites/site1'
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName : Test deny assignment 1
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals : {
DisplayName: testuser
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
}
ExcludePrincipals : {}
IsSystemProtected : True
Id : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1/providers/Microsoft.Authorization/denyAssignments/594e3d9da-3700-4113-aab4-15f6c173d794
DenyAssignmentName : Test deny assignment 2
Description : Test deny assignment for PS cmdlets
Actions : {foo/*}
NotActions : {foo/*/read}
DataActions : {foo/*}
NotDataActions : {}
Scope : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1
DoNotApplyToChildScopes : False
Principals : {
DisplayName: testuser
ObjectType: User
ObjectId: f8d526a0-54eb-4941-ae69-ebf4a334d0f0
,
DisplayName: TestApp
ObjectType: ServicePrincipal
ObjectId: f2dc21ac-702a-4bde-a4ce-146edf751d81
}
ExcludePrincipals : {}
IsSystemProtected : True參數
-DefaultProfile
用於與 azure 通訊的認證、帳戶、租用戶和訂用帳戶
| Type: | IAzureContextContainer |
| Aliases: | AzContext, AzureRmContext, AzureCredential |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DenyAssignmentName
拒絕指派的名稱。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ExpandPrincipalGroups
如果指定，則會傳回直接指派給使用者和使用者所屬群組的拒絕指派（可轉移）。 僅支援用戶主體。
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Id
拒絕指派完整標識碼或 GUID。 當標識碼以 GUID 的形式提供時，會將目前的訂用帳戶視為預設範圍。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ObjectId
使用者、群組或服務主體的 Microsoft Entra ObjectId。 篩選對指定主體所做的所有拒絕指派。
| Type: | Nullable<T>[Guid] |
| Aliases: | PrincipalId |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ParentResource
使用 ResourceName 參數指定之資源階層中的父資源。 必須與 ResourceGroupName、ResourceType 和 ResourceName 參數搭配使用。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ResourceGroupName
資源組名。 列出在指定資源群組上生效的拒絕指派。 搭配 ResourceName、ResourceType 和 ParentResource 參數使用時，命令會列出資源群組內資源有效的拒絕指派。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ResourceName
資源名稱。 例如 storageaccountprod。 必須與 ResourceGroupName、ResourceType 和 （選擇性）ParentResource 參數搭配使用。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ResourceType
資源類型。 例如 Microsoft.Network/virtualNetworks。 必須與 ResourceGroupName、ResourceName 和 （選擇性）ParentResource 參數搭配使用。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-Scope
角色指派的範圍。 以相對 URI 的格式。 例如 /subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG。 它必須以 “/subscriptions/{id}” 開頭。 命令會篩選在該範圍內生效的所有拒絕指派。
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ServicePrincipalName
服務主體的 ServicePrincipalName。 篩選對指定之 Microsoft Entra 應用程式所做的所有拒絕指派。
| Type: | String |
| Aliases: | SPN |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-SignInName
用戶的電子郵件地址或用戶主體名稱。 篩選對指定使用者所做的所有拒絕指派。
| Type: | String |
| Aliases: | Email, UserPrincipalName |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
輸入
輸出
備註
關鍵詞：azure， azurerm， arm， 資源， 管理， 管理員， 資源， 群組， 範本， 部署
意見反應
即將登場：在 2024 年，我們將逐步淘汰 GitHub 問題作為內容的意見反應機制，並將它取代為新的意見反應系統。 如需詳細資訊，請參閱：https://aka.ms/ContentUserFeedback。
提交並檢視相關的意見反應