Azure / Azure/azure-powershell
`Get-AzSubscriptionAlias` does not show aliases when permissions are granted through a security group
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
When using the `Get-AzSubscriptionAlias` cmdlet without any additional parameter, I am seeing aliases for only a subset of the subscriptions I have access to. There should be more aliases visible, but the output is incomplete.
The missing subscription aliases have permissions granted through security group membership, where the security group has the `Reader` role assigned on those subscriptions aliases.
**The missing aliases can still be found when using the `-AliasName` parameter:**
```
PS C:\Users> Get-AzSubscriptionAlias -AliasName CLAC0001234
AcceptOwnershipState :
AcceptOwnershipUrl :
AliasName : CLAC0001234
BillingScope :
CreatedTime :
DisplayName :
Id : /providers/Microsoft.Subscription/aliases/CLAC0001234
ManagementGroupId :
ProvisioningState : Succeeded
ResellerId :
ResourceGroupName :
SubscriptionId :
SubscriptionOwnerId :
SystemDataCreatedAt :
SystemDataCreatedBy :
SystemDataCreatedByType :
SystemDataLastModifiedAt :
SystemDataLastModifiedBy :
SystemDataLastModifiedByType :
Tag : {
}
Type : Microsoft.Subscription/aliases
Workload :
```
### Issue script & Debug output
```PowerShell
Too much sensitive data in debug output, repro is explained.
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 7.5.4
PSEdition Core
GitCommitId 7.5.4
OS Microsoft Windows 10.0.26100
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 5.3.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 8.0.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
Script 0.12.0 Az.Subscription {Disable-AzSubscription, Enable-AzSubscription, Get-AzSubscriptionAcceptOwnershipStatus, Get-AzSubscriptionAlias…}
```
### Error output
```PowerShell
There is no error when running the `Get-AzSubscriptionAlias` cmdlet, but it does not show all the aliases for the subscriptions user have access to, and the ones missing are through security group membership with `Reader` on the subscription aliases.
```
Contributor guide
Assessment
This issue has not been assessed yet.