Azure / Azure/azure-powershell

Get-AzRoleAssignment no longer reports Orphaned Role Assignments in Az.Resources 9.0.1 (regression)

Open
#29,311 3 comments 0 reactions 1 assignee Claimed by @isra-fel View on GitHub
act-identity-squad ARM - RBAC bug customer-reported Investigate :mag: Tracking
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

This is a **regression** of issue #16981 which was fixed in Az.Resources 5.4.0 (PR #17167) but has **returned in Az.Resources 9.0.1**.

In Az.Resources < 5.1.0, `Get-AzRoleAssignment` properly marked deleted principals with `ObjectType = 'Unknown'`, enabling cleanup of orphaned role assignments:

```powershell
Get-AzRoleAssignment | Where-Object { $_.ObjectType -eq 'Unknown' } | Remove-AzRoleAssignment
```

This behavior was **broken in 5.1.0** (Feb 2022) and **fixed in 5.4.0** (Mar 2022) via PR #17167.

However, with **Az.Resources 9.0.1** (released Jan 2026), orphaned role assignments are **no longer marked with `ObjectType = 'Unknown'`**.

Unclear exactly in which version it was introduced again, we jumped from 7.3.0 to 9.0.1. Hypothesis is it was introduced in 9.0.0, due to the **AutoRest v4 code generator migration in Az.Resources 9.0.0** (documented in changelog as "Introduced various new features by upgrading code generator") likely **regenerated the cmdlet code and lost this fix**.

## Steps to reproduce

1. Create a service principal and assign it an Azure role
2. Delete the service principal from Entra ID (role assignment remains)
3. Query role assignments with Az.Resources 9.0.1:
```powershell
Get-AzRoleAssignment | Where-Object { $_.ObjectType -eq 'Unknown' }
```
4. **Actual**: No results (orphaned assignment not detected)
5. **Expected**: Orphaned assignment returned with `ObjectType = 'Unknown'`

### Issue script & Debug output

```PowerShell
$orphans = Get-AzRoleAssignment | Where-Object { $_.ObjectType -eq 'Unknown' }
$orphans.Count() # yields 0, when via protal there are clearly "Unknown" assignments
```

### Environment data

```PowerShell
$PSVersionTable

Name Value
---- -----
PSVersion 7.5.5
PSEdition Core
GitCommitId 7.5.5
OS Ubuntu 24.04.4 LTS
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
Get-Installedmodule -Name Az.Resources

Version Name Repository Description
------- ---- ---------- -----------
9.0.1 Az.Resources PSGallery Microsoft Azure PowerShell - Azure Resource Manager and Active Directory cmdlets in Windows PowerShell and PowerShell Core. Manages subscriptions, tenants, resource groups, deployment templates, providers, and resource permissions in Azure Resource Manager. Provides c…
```

### Error output

```PowerShell
N/A
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.