Azure / Azure/azure-cli

Role assigned to scope not returned unless scope is specified

Open
#14,302 9 comments 0 reactions 1 assignee Assigned to @jiasli View on GitHub
act-identity-squad Feature Candidate feature-request Possible-Solution RBAC Similar-Issue
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Describe the bug**

When I assign a role to an SP at a given scope that role is not returned with the `az role assignment list` command.

> Doesn't work in both CLI and Portal, works in REST API

Both
```
az role assignment list --assignee [objectId]
az role assignment list --assignee [appId]
```

Do not return roles that are assigned.
![image](https://user-images.githubusercontent.com/2163001/87050374-07a85300-c1b3-11ea-9502-43d29bfa01fc.png)

The portal does not show roles
![image](https://user-images.githubusercontent.com/2163001/87050334-f95a3700-c1b2-11ea-847a-8618ddf0ffaa.png)

But, if I add a scope, roles are returned:

![image](https://user-images.githubusercontent.com/2163001/87050464-24dd2180-c1b3-11ea-8eda-f90272d89015.png)

The REST API does not require scope. Roles are returned without scope.

`https://management.azure.com/subscriptions/{{subscriptionId}}/providers/Microsoft.Authorization/roleAssignments?api-version=2020-04-01-preview&$filter=assignedTo('aae06f9f-3c90-442b-bdc4-f688818132c6')`

![image](https://user-images.githubusercontent.com/2163001/87050564-46d6a400-c1b3-11ea-80ba-4f23befc3697.png)

If I create a new SP and assign it the Tag Contributor role, then that roles is returned when using the CLI without scope.

**To Reproduce**

1. Create a new SP
`az ad sp create-for-rbac --skip-assignment`
2. Assign a role with scope
`az role assignment create --assignee 32c6eeab-6338-4bdb-b21f-69836b2d99c4 --role "Tag Contributor" --scope /subscriptions/25fd0362-aa79-488b-b37b-d6e892009fdf/resourceGroups/aztagsync1`
3. Query for roles
`az role assignment list --assignee 32c6eeab-6338-4bdb-b21f-69836b2d99c4`

Zero results are returned.

**Expected behavior**

Roles are returned without specifying a scope.

This is also true for the Azure portal, but I'm not sure where to report that bug. If you know, Please let me know.

**Environment summary**

azure-cli 2.8.0
WSL2

**Additional context**

I'm Microsoft, so ping me on Teams to diagnose further.

azsdke2e

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.