CODEWITHSUNDEEP
azureazure-active-directoryrbac
Sienna
Sienna

Reputation: 1699

Azure RBAC Permissions Tree?

Is there a way to query Azure (via REST or CLI) to see which permissions are required/granted for certain actions?

For example, if I wanted to assign an SPN with Microsoft.Compute/virtualMachines/write permissions so it could create a VM, I would want to review what other permissions are granted/required before assigning it to said SPN.

Upvotes: 1

Views: 417

Answers (2)

CHEEKATLAPRADEEP
CHEEKATLAPRADEEP

Reputation: 12788

The Actions property of a custom role specifies the Azure operations to which the role grants access. It is a collection of operation strings that identify securable operations of Azure resource providers. Operation strings follow the format of

Microsoft.<ProviderName>/<ChildResourceType>/<action>

Use Get-AzureRmProviderOperation (in PowerShell) or azure provider operations show (in Azure CLI) to list operations of Azure resource providers.

For more details, refer "Create custom roles for Azure Role-Based Access Control".

Upvotes: 1

Jarnstrom
Jarnstrom

Reputation: 477

As far as I know there is no way to list dependencies in the way you describe. The Powershell cmdlet Get-AzureRmProviderOperation gives some good information on what permissions needed. https://learn.microsoft.com/en-us/powershell/module/azurerm.resources/get-azurermprovideroperation?view=azurermps-5.0.0

enter image description here

Upvotes: 1

Related Questions