Azure / Azure/azure-cli

Role assignment list includes classic administrators from the wrong scope

Open
#16,016 1 comment 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad feature-request RBAC
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Describe the bug

When using `az role assignment list` with both `--scope` and `--include-classic-administrators`, classic administrators are shown for the current subscription, not taking the subscription specified in the scope into account.

## To Reproduce:

- Create two Azure subscriptions
- `az account set --subscription `
- `az role assignment list --scope "/subscriptions/" --include-classic-administrators`

Output will look something like this (some properties were truncated):

```json
[
{
"id": "/subscriptions//providers/Microsoft.Authorization/roleAssignments/",
"name": "",
"scope": "/subscriptions/",
...
},
{
"id": "NA(classic admins)",
"name": "NA(classic admins)",
"scope": "/subscriptions/",
...
}
]
```

## Expected Behavior

Roles and custom administrators from the second subscription are shown.

## Environment Summary
```
Windows-10-10.0.19041-SP0
Python 3.6.8
Installer: MSI

azure-cli 2.15.1
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.