Azure / Azure/azure-powershell

`Get-AzSubscriptionAlias` does not show aliases when permissions are granted through a security group

Open
#29,216 0 comments 0 reactions 0 assignees View on GitHub
bug customer-reported
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

When using the `Get-AzSubscriptionAlias` cmdlet without any additional parameter, I am seeing aliases for only a subset of the subscriptions I have access to. There should be more aliases visible, but the output is incomplete.

The missing subscription aliases have permissions granted through security group membership, where the security group has the `Reader` role assigned on those subscriptions aliases.

Image




**The missing aliases can still be found when using the `-AliasName` parameter:**
```
PS C:\Users> Get-AzSubscriptionAlias -AliasName CLAC0001234

AcceptOwnershipState :
AcceptOwnershipUrl :
AliasName : CLAC0001234
BillingScope :
CreatedTime :
DisplayName :
Id : /providers/Microsoft.Subscription/aliases/CLAC0001234
ManagementGroupId :
ProvisioningState : Succeeded
ResellerId :
ResourceGroupName :
SubscriptionId :
SubscriptionOwnerId :
SystemDataCreatedAt :
SystemDataCreatedBy :
SystemDataCreatedByType :
SystemDataLastModifiedAt :
SystemDataLastModifiedBy :
SystemDataLastModifiedByType :
Tag : {
}
Type : Microsoft.Subscription/aliases
Workload :
```

### Issue script & Debug output

```PowerShell
Too much sensitive data in debug output, repro is explained.
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.5.4
PSEdition Core
GitCommitId 7.5.4
OS Microsoft Windows 10.0.26100
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 5.3.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 8.0.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
Script 0.12.0 Az.Subscription {Disable-AzSubscription, Enable-AzSubscription, Get-AzSubscriptionAcceptOwnershipStatus, Get-AzSubscriptionAlias…}
```

### Error output

```PowerShell
There is no error when running the `Get-AzSubscriptionAlias` cmdlet, but it does not show all the aliases for the subscriptions user have access to, and the ones missing are through security group membership with `Reader` on the subscription aliases.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.