az role assignment

Manage role assignments.

Commands

az role assignment create

Create a new role assignment for a user, group, or service principal.

az role assignment delete

Delete role assignments.

az role assignment list

List role assignments.

az role assignment list-changelogs

List changelogs for role assignments.

az role assignment update

Update an existing role assignment for a user, group, or service principal.

az role assignment create

Create a new role assignment for a user, group, or service principal.

az role assignment create --role
                          [--assignee]
                          [--assignee-object-id]
                          [--assignee-principal-type {Application, DirectoryObjectOrGroup, DirectoryRoleTemplate, Everyone, ForeignGroup, Group, MSI, ServicePrincipal, Unknown, User}]
                          [--condition]
                          [--condition-version]
                          [--description]
                          [--resource-group]
                          [--scope]
                          [--subscription]

Examples

Create role assignment for an assignee.

az role assignment create --assignee sp_name --role a_role

Create role assignment for an assignee with description and condition.

az role assignment create --role "Owner" --assignee "Jhon.Doe@Contoso.com" --description "Role assignment foo to check on bar" --condition "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'" --condition-version "2.0"

Create a new role assignment for a user, group, or service principal. (autogenerated)

az role assignment create --assignee 00000000-0000-0000-0000-000000000000 --role "Storage Account Key Operator Service Role" --scope $id

Required Parameters

--role

Role name or id.

Optional Parameters

--assignee

Represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.

--assignee-object-id

Use this parameter instead of '--assignee' to bypass graph permission issues. This parameter only works with object ids for users, groups, service principals, and managed identities. For managed identities use the principal id. For service principals, use the object id and not the app id.

--assignee-principal-type

Use with --assignee-object-id to avoid errors caused by propagation latency in AAD Graph.

accepted values: Application, DirectoryObjectOrGroup, DirectoryRoleTemplate, Everyone, ForeignGroup, Group, MSI, ServicePrincipal, Unknown, User
--condition

Condition under which the user can be granted permission.

--condition-version

Version of the condition syntax. If --condition is specified without --condition-version, default to 2.0.

--description

Description of role assignment.

--resource-group -g

Use it only if the role or assignment was added at the level of a resource group.

--scope

Scope at which the role assignment or definition applies to, e.g., /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az role assignment delete

Delete role assignments.

az role assignment delete [--assignee]
                          [--ids]
                          [--include-inherited]
                          [--resource-group]
                          [--role]
                          [--scope]
                          [--subscription]
                          [--yes]

Examples

Delete role assignments. (autogenerated)

az role assignment delete --assignee 00000000-0000-0000-0000-000000000000 --role "Storage Account Key Operator Service Role"

Optional Parameters

--assignee

Represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.

--ids

Space-separated role assignment ids.

--include-inherited

Include assignments applied on parent scopes.

--resource-group -g

Use it only if the role or assignment was added at the level of a resource group.

--role

Role name or id.

--scope

Scope at which the role assignment or definition applies to, e.g., /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--yes -y

Continue to delete all assignments under the subscription.

az role assignment list

List role assignments.

By default, only assignments scoped to subscription will be displayed. To view assignments scoped by resource or group, use --all.

az role assignment list [--all]
                        [--assignee]
                        [--include-classic-administrators {false, true}]
                        [--include-groups]
                        [--include-inherited]
                        [--query-examples]
                        [--resource-group]
                        [--role]
                        [--scope]
                        [--subscription]

Optional Parameters

--all

Show all assignments under the current subscription.

--assignee

Represent a user, group, or service principal. supported format: object id, user sign-in name, or service principal name.

--include-classic-administrators

List default role assignments for subscription classic administrators, aka co-admins.

accepted values: false, true
--include-groups

Include extra assignments to the groups of which the user is a member(transitively).

--include-inherited

Include assignments applied on parent scopes.

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--resource-group -g

Use it only if the role or assignment was added at the level of a resource group.

--role

Role name or id.

--scope

Scope at which the role assignment or definition applies to, e.g., /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az role assignment list-changelogs

List changelogs for role assignments.

az role assignment list-changelogs [--end-time]
                                   [--start-time]
                                   [--subscription]

Optional Parameters

--end-time

The end time of the query in the format of %Y-%m-%dT%H:%M:%SZ, e.g. 2000-12-31T12:59:59Z. Defaults to the current time.

--start-time

The start time of the query in the format of %Y-%m-%dT%H:%M:%SZ, e.g. 2000-12-31T12:59:59Z. Defaults to 1 Hour prior to the current time.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az role assignment update

Update an existing role assignment for a user, group, or service principal.

az role assignment update --role-assignment
                          [--subscription]

Examples

Update a role assignment from a JSON file.

az role assignment update --role-assignment assignment.json

Update a role assignment from a JSON string. (Bash)

az role assignment update --role-assignment '{
    "canDelegate": null,
    "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals '"'"'foo'"'"'",
    "conditionVersion": "2.0",
    "description": "Role assignment foo to check on bar",
    "id": "/subscriptions/00000001-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Authorization/roleAssignments/3eabdd43-375b-4dbd-8dc4-04acd15ce56b",
    "name": "3eabdd43-375b-4dbd-8dc4-04acd15ce56b",
    "principalId": "00000002-0000-0000-0000-000000000000",
    "principalType": "User",
    "resourceGroup": "rg1",
    "roleDefinitionId": "/subscriptions/00000001-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
    "scope": "/subscriptions/00000001-0000-0000-0000-000000000000/resourceGroups/rg1",
    "type": "Microsoft.Authorization/roleAssignments"
}'

Required Parameters

--role-assignment

Description of an existing role assignment as JSON, or a path to a file containing a JSON description.

Optional Parameters

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.