Azure / Azure/azure-powershell

Set-AzRoleDefinition fails to update if Assignable Scope is changed to new Management Group

Open
#13,449 5 comments 0 reactions 0 assignees View on GitHub
act-identity-squad ARM - RBAC Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

## Description
If you do the Set-AzRoleDefinition it will fail if you change the scope from one Management Group to another. It will say it can't find a role definition by that ID. It appears to be relying on the assignable scope to look for the ID and the role isn't currently in the new assignable scope you are trying to update to.

Note that this works fine in Azure CLI.

## Steps to reproduce
Try to reproduce the scenario described [here](https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#issues-with-breaking-the-role-definition-and-assignment-hierarchy-path). In particular we are trying to reproduce the approach described as "Change the assignable scope within the role definition. In the above example, you can update the assignable scopes from Marketing to Root Management Group so that the definition can be reached by both branches of the hierarchy."

1. Create custom role with an assignable scope set to a custom MG.
2. Get the role definition and modify the assignable scope to be the tenant root assignable scope.
3. Run Set-AzRoleDefinition to update the role definition to the new scope. This will fail with a message saying it can't find a role definition with the specified ID.

```powershell

```

## Environment data

```

```

## Module versions

```powershell

```

## Debug output

```

```

## Error output

```

```

Contributor guide

Open the contributing guide

Research direction

Start at the Set-AzRoleDefinition entry point and trace how the existing role ID is looked up when AssignableScopes changes. Reproduce the management-group transition described in the issue, then verify that updating the role definition succeeds when moving it to the tenant root scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.