az role assignment

Manage role assignments.

Commands

az role assignment create	Create a new role assignment for a user, group, or service principal.
az role assignment delete	Delete role assignments.
az role assignment list	List role assignments.
az role assignment list-changelogs	List changelogs for role assignments.
az role assignment update	Update an existing role assignment for a user, group, or service principal.

az role assignment create

Edit

Create a new role assignment for a user, group, or service principal.

az role assignment create --role
                          [--assignee]
                          [--assignee-object-id]
                          [--assignee-principal-type {Application, DirectoryObjectOrGroup, DirectoryRoleTemplate, Everyone, ForeignGroup, Group, MSI, ServicePrincipal, Unknown, User}]
                          [--condition]
                          [--condition-version]
                          [--description]
                          [--resource-group]
                          [--scope]
                          [--subscription]

Examples

Create role assignment for an assignee.

az role assignment create --assignee sp_name --role a_role

Create role assignment for an assignee with description and condition.

az role assignment create --role "Owner" --assignee "Jhon.Doe@Contoso.com" --description "Role assignment foo to check on bar" --condition "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'" --condition-version "2.0"

Create a new role assignment for a user, group, or service principal. (autogenerated)

az role assignment create --assignee 00000000-0000-0000-0000-000000000000 --role "Storage Account Key Operator Service Role" --scope $id

Required Parameters

--role

Role name or id.

Optional Parameters

--assignee

Represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.

--assignee-object-id

Use this parameter instead of '--assignee' to bypass graph permission issues. This parameter only works with object ids for users, groups, service principals, and managed identities. For managed identities use the principal id. For service principals, use the object id and not the app id.

--assignee-principal-type

Use with --assignee-object-id to avoid errors caused by propagation latency in AAD Graph.

accepted values: Application, DirectoryObjectOrGroup, DirectoryRoleTemplate, Everyone, ForeignGroup, Group, MSI, ServicePrincipal, Unknown, User

--condition

Condition under which the user can be granted permission.

--condition-version

Version of the condition syntax. If --condition is specified without --condition-version, default to 2.0.

--description

Description of role assignment.

--resource-group -g

Use it only if the role or assignment was added at the level of a resource group.

--scope

Scope at which the role assignment or definition applies to, e.g., /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az role assignment delete

Edit

Delete role assignments.

az role assignment delete [--assignee]
                          [--ids]
                          [--include-inherited]
                          [--resource-group]
                          [--role]
                          [--scope]
                          [--subscription]
                          [--yes]

Examples

Delete role assignments. (autogenerated)

az role assignment delete --assignee 00000000-0000-0000-0000-000000000000 --role "Storage Account Key Operator Service Role"

Optional Parameters

--assignee

Represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.

--ids

Space-separated role assignment ids.

--include-inherited

Include assignments applied on parent scopes.

--resource-group -g

Use it only if the role or assignment was added at the level of a resource group.

--role

Role name or id.

--scope

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--yes -y

Continue to delete all assignments under the subscription.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az role assignment list

Edit

List role assignments.

By default, only assignments scoped to subscription will be displayed. To view assignments scoped by resource or group, use --all.

az role assignment list [--all]
                        [--assignee]
                        [--include-classic-administrators {false, true}]
                        [--include-groups]
                        [--include-inherited]
                        [--query-examples]
                        [--resource-group]
                        [--role]
                        [--scope]
                        [--subscription]

Optional Parameters

--all

Show all assignments under the current subscription.

--assignee

Represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.

--include-classic-administrators

List default role assignments for subscription classic administrators, aka co-admins.

accepted values: false, true

--include-groups

Include extra assignments to the groups of which the user is a member(transitively).

--include-inherited

Include assignments applied on parent scopes.

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--resource-group -g

Use it only if the role or assignment was added at the level of a resource group.

--role

Role name or id.

--scope

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az role assignment list-changelogs

Edit

List changelogs for role assignments.

az role assignment list-changelogs [--end-time]
                                   [--start-time]
                                   [--subscription]

Optional Parameters

--end-time

The end time of the query in the format of %Y-%m-%dT%H:%M:%SZ, e.g. 2000-12-31T12:59:59Z. Defaults to the current time.

--start-time

The start time of the query in the format of %Y-%m-%dT%H:%M:%SZ, e.g. 2000-12-31T12:59:59Z. Defaults to 1 Hour prior to the current time.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az role assignment update

Edit

Update an existing role assignment for a user, group, or service principal.

az role assignment update --role-assignment
                          [--subscription]

Examples

Update a role assignment from a JSON file.

az role assignment update --role-assignment assignment.json

Update a role assignment from a JSON string. (Bash)

az role assignment update --role-assignment '{
    "canDelegate": null,
    "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals '"'"'foo'"'"'",
    "conditionVersion": "2.0",
    "description": "Role assignment foo to check on bar",
    "id": "/subscriptions/00000001-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Authorization/roleAssignments/3eabdd43-375b-4dbd-8dc4-04acd15ce56b",
    "name": "3eabdd43-375b-4dbd-8dc4-04acd15ce56b",
    "principalId": "00000002-0000-0000-0000-000000000000",
    "principalType": "User",
    "resourceGroup": "rg1",
    "roleDefinitionId": "/subscriptions/00000001-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
    "scope": "/subscriptions/00000001-0000-0000-0000-000000000000/resourceGroups/rg1",
    "type": "Microsoft.Authorization/roleAssignments"
}'

Required Parameters

--role-assignment

Description of an existing role assignment as JSON, or a path to a file containing a JSON description.

Optional Parameters

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az role assignment

Commands

az role assignment create

Examples

Required Parameters

Optional Parameters

az role assignment delete

Examples

Optional Parameters

az role assignment list

Optional Parameters

az role assignment list-changelogs

Optional Parameters

az role assignment update

Examples

Required Parameters

Optional Parameters

此页面有帮助吗?

此页面有帮助吗?