Azure / Azure/azure-powershell
Set-AzRoleDefinition fails to update if Assignable Scope is changed to new Management Group
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
## Description
If you do the Set-AzRoleDefinition it will fail if you change the scope from one Management Group to another. It will say it can't find a role definition by that ID. It appears to be relying on the assignable scope to look for the ID and the role isn't currently in the new assignable scope you are trying to update to.
Note that this works fine in Azure CLI.
## Steps to reproduce
Try to reproduce the scenario described [here](https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#issues-with-breaking-the-role-definition-and-assignment-hierarchy-path). In particular we are trying to reproduce the approach described as "Change the assignable scope within the role definition. In the above example, you can update the assignable scopes from Marketing to Root Management Group so that the definition can be reached by both branches of the hierarchy."
1. Create custom role with an assignable scope set to a custom MG.
2. Get the role definition and modify the assignable scope to be the tenant root assignable scope.
3. Run Set-AzRoleDefinition to update the role definition to the new scope. This will fail with a message saying it can't find a role definition with the specified ID.
```powershell
```
## Environment data
```
```
## Module versions
```powershell
```
## Debug output
```
```
## Error output
```
```
Contributor guide
Research direction
Start at the Set-AzRoleDefinition entry point and trace how the existing role ID is looked up when AssignableScopes changes. Reproduce the management-group transition described in the issue, then verify that updating the role definition succeeds when moving it to the tenant root scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, powershell
- Domain
- authorization, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100