Report Azure role assignments
Documentation: Microsoft Learn
Report Azure role assignments with Get-AzRoleAssignment, including principal identity, role, scope, and object type in the active context.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-AzRoleAssignment | Select-Object DisplayName,SignInName,RoleDefinitionName,Scope,ObjectType- Stage 1Get-AzRoleAssignment
Positional values or no named parameters - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-AzRoleAssignment retrieves the assignments visible to the current context, and the projection pairs each principal's display name and sign-in name with the role definition, the scope string the assignment applies at, and ObjectType, which separates a user from a group or a service principal.
Adapting it
Narrow the query with -Scope to one resource group, or add -IncludeClassicAdministrators when auditing an older subscription that may still carry co-administrators.
Requirements
Az.Resources with a session holding roleAssignments read plus directory read for name resolution.
If the result is unexpected
The role-assignment report appears to omit effective access.
Scope inheritance, group membership and eligible role activation can differ from direct assignments.
- Record the queried scope and inspect a known principal's assignment and inheritance path.
Validate the result
Rows identify principal, role and scope without claiming to capture every source of effective access.
Keep the check reliable
Separate direct assignments, inherited access and eligible roles in access reviews.
