get role assignments for app maker

Using Power Automate to get the list of users an app has been shared with?

Have you ever wanted to get the list of users a canvas app has been shared with?

Of course you could go to the maker portal and look at it there:

But you can also do it in your flows easily (assuming you have permissions).

There is Power Apps for Admins Connector:

https://docs.microsoft.com/en-us/connectors/powerappsforadmins/

And it offers “Get App Role Assignments as Admin” action which will give you the list of users for any given app in any given environment.

Here is an example:

As you can see, the output of this flow matches the original screenshot. You just need to pass environment ID and application ID to the action

And, from there, you need to parse json and format the output the way you want it to be formatted.

So how/why would we use it? In reality, this could probably help with monitoring/notifications. Which is where a lot of this functionality would already be available out of the box in the CoE toolkit:

https://docs.microsoft.com/en-us/power-platform/guidance/coe/starter-kit

But, if you don’t want to deal with the CoE toolkit rollout yet, you might implement your own flow for now using Power Apps for Admins Connector. And if you are wondering whether there is a similar connector for Power Automate flows – the answer is yes, here is another link: https://docs.microsoft.com/en-us/connectors/microsoftflowforadmins/

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Save my name, email, and website in this browser for the next time I comment.

Good Workaround!

Full IGA using Azure AD – Getting app role assignments using PowerShell

In this post I will quickly demo how to use PowerShell to get app role assignments for all application using the Microsoft Graph.

You should have followed my previous post in order to have created an application, added some appRoles to the manifest and granted access to the Graph.

Let’s recap the important parts:

1 – Create an enterprise application in Azure AD

2 – Go to “app registrations”, find the app and add appRoles to the manifest

The following are provided by default, disable those and add some custom ones. See the below example roles.

3 – Go back to enterprise applications and assign users some roles

4 – Grant access to the required Graph resources

Go to app registrations, find the application and go to “API permissions”. Click “Add a permission”:

Select the Microsoft Graph:

Choose Application permissions, as we are doing things without a user context:

Add “User.Read.All” and “Group.Read.All” and click save.

You will see that the added permissions now have “Not granted for <Organization>” as status. Click “Grant admin consent for <Organization>” in order to enable these new permissions:

This is what it should look like:

5 – Request data with PowerShell

First, generate a secret under app registrations in Azure AD. This is the $secret variable in the below PowerShells.

Go the enterprise application and copy the “Application ID” – this is the $clientid variable in the below PowerShells.

Copy “Object ID” – this is the $servicePrincipalId variable in the below PowerShells.

The $tenant variable can be either any custom domain registered in the tenant, the default domain or the tenant id (you can find it here) found on the app registrations page on your application.

The first example PowerShell will return a simple grid view with a multi valued column containing the roles of each assigned object. The script will not dig into the group members.

And here is an example for you that also digs into the different assigned groups and fetches all transitive members of those:

That’s it, I have now gone through three ways of getting the application role assignments from Azure AD into your application:

• SCIM provisioning
• At sign in (OAuth ID Token or SAML Claim)
• Fetching by Graph calls

The next posts will focus on how to actually manage application role assignments, dynamically assigning, using Entitlement Management to allow both internal and invited users to request access and other means. Stay tuned!

Share this:

• Full IGA using Azure AD

Published by Marius Solbakken

View all posts by Marius Solbakken

One thought on “ Full IGA using Azure AD – Getting app role assignments using PowerShell ”

• Pingback: Full IGA using Azure AD – Entitlement Management – Good Workaround!

Leave a comment Cancel reply

• Already have a WordPress.com account? Log in now.
• Subscribe Subscribed
• Copy shortlink
• Report this content
• View post in Reader
• Manage subscriptions
• Collapse this bar

Power Apps for Admins

Power Apps Management Connector for Administrators

Get-AdminAppRoleAssignment

Summary : Get App Role Assignments as Admin

Description : Returns permissions for a PowerApp.

PowerAppsforAdmins.Get-AdminAppRoleAssignment (string environment, string app, [Optional]string api-version, [advanced][Optional]integer $top)

Parameters:

          Type: Get-AdminAppRoleAssignmentResponse

Set-AdminAppOwner

Summary : Set App Owner

Description : Updates a PowerApp's owner role, and specifies the old owner's new role.

PowerAppsforAdmins.Set-AdminAppOwner (string environment, string app, [Optional]string api-version, [Optional]string Content-Type, [Optional]Set-AdminAppOwnerParameterBody body)

Get-AdminApps

Summary : Get Apps as Admin

Description : Returns a list of apps.

PowerAppsforAdmins.Get-AdminApps (string environment, [Optional]string api-version, [advanced][Optional]integer $top, [Optional]string $skiptoken)

          Type: ResourceArray[PowerApp]

Get-AdminApp

Summary : Get App as Admin

Description : Returns a PowerApp.

PowerAppsforAdmins.Get-AdminApp (string environment, string app, [Optional]string api-version)

          Type: PowerApp

Remove-AdminApp

Summary : Remove App as Admin

Description : Deletes a PowerApp.

PowerAppsforAdmins.Remove-AdminApp (string environment, string app, [Optional]string api-version)

Edit-AdminAppRoleAssignment

Summary : Edit App Role Assignment as Admin

Description : Sets permissions for a PowerApp.

PowerAppsforAdmins.Edit-AdminAppRoleAssignment (string environment, string app, [Optional]string api-version, [Optional]string $filter, [Optional]Edit-AdminAppRoleAssignmentParameterBody body)

          Type: Edit-AdminAppRoleAssignmentResponse

Get-AdminConnections

Summary : Get Connections as Admin

Description : Returns a list of Connections.

PowerAppsforAdmins.Get-AdminConnections (string environment, [Optional]string api-version, [advanced][Optional]integer $top)

          Type: Get-AdminConnectionsResponse

Remove-AdminConnection

Summary : Remove Connection as Admin

Description : Deletes a Connection.

PowerAppsforAdmins.Remove-AdminConnection (string environment, string connectorName, string connectionName, [Optional]string api-version)

Get-AdminConnectionRoleAssignment

Summary : Get Connection Role Assignments as Admin

Description : Returns all permissions for a Connection.

PowerAppsforAdmins.Get-AdminConnectionRoleAssignment (string environment, string connectorName, string connectionName, [Optional]string api-version, [advanced][Optional]integer $top)

          Type: Get-AdminConnectionRoleAssignmentResponse

Edit-AdminConnectionRoleAssignment

Summary : Edit Connection Role Assignment as Admin

Description : Sets permissions for a Connection.

PowerAppsforAdmins.Edit-AdminConnectionRoleAssignment (string environment, string connector, string connection, [Optional]string api-version, [Optional]string Content-Type, [Optional]Edit-AdminConnectionRoleAssignmentParameterBody body)

Get-AdminConnectors

Summary : Get Custom Connectors as Admin

Description : Returns a list of custom Connectors.

PowerAppsforAdmins.Get-AdminConnectors (string environment, [Optional]string api-version, [advanced][Optional]integer $top)

          Type: Get-AdminConnectorsResponse

Get-AdminConnectorRoleAssignment

Summary : Get Connector Role Assignments as Admin

Description : Returns permissions for a custom Connector.

PowerAppsforAdmins.Get-AdminConnectorRoleAssignment (string environment, string connectorName, [Optional]string api-version, [advanced][Optional]integer $top)

          Type: Get-AdminConnectorRoleAssignmentResponse

Edit-AdminConnectorRoleAssignment

Summary : Edit Connector Role Assignment as Admin

Description : Sets permissions for a Connector.

PowerAppsforAdmins.Edit-AdminConnectorRoleAssignment (string environment, string connectorName, [Optional]string api-version, [Optional]string Content-Type, [Optional]Edit-AdminConnectorRoleAssignmentParameterBody body)

ConnectionReference

Description :

          Properties:

Edit-AdminAppRoleAssignmentParameterBody

Description : properties

Description : principal

Edit-AdminAppRoleAssignmentResponse

Description : App Role Assignment properties object.

Description : App Role Assignment principal object.

ResourceResponsesItem

Edit-adminconnectionroleassignmentparameterbody, edit-adminconnectorroleassignmentparameterbody, get-adminapproleassignmentresponse.

Description : PowerApp Role Assignment properties object.

Description : PowerApp Role Assignment principal object.

Get-AdminConnectionRoleAssignmentResponse

Description : Connection Role Assignment properties.

Description : Connection Role Assignment principal object.

Get-AdminConnectionsResponse

Description : Connection properties.

StatusesItem

Description : Connection status error.

ConnectionParameters

Description : Connection property parameters object.

Description : Connection creator principal object.

Environment

Description : Connection Environment object.

TestLinksItem

Get-adminconnectorroleassignmentresponse.

Description : Connector Role Assignment principal object.

Get-AdminConnectorsResponse

Description : Connector connection parameters.

Description : metadata

Description : contact

Description : license

ApiDefinitions

Description : Connector api definitions.

Description : Connector creator's principal object.

Description : Connector last modified by principal object.

Description : Connector Environment.

Description : PowerApp properties object.

CreatedByClientVersion

Description : PowerApp property createdByClientVersion object.

MinClientVersion

Description : PowerApp property minClientVersion object.

Description : PowerApp owner principal object.

Description : PowerApp createdBy principal object.

LastModifiedBy

Description : PowerApp lastModifiedBy object.

Description : PowerApp appUri object.

DocumentUri

Description : PowerApp appUri documentUri object.

UserAppMetadata

Description : PowerApp property userAppMetadata object.

Description : PowerApp Environment property object.

Description : tags

ResourceArray[PowerApp]

Set-adminappownerparameterbody.

• Microsoft Power Automate Community
• Welcome to the Community!
• News & Announcements
• Get Help with Power Automate
• General Power Automate Discussion
• Using Connectors
• Building Flows
• Using Flows
• Power Automate Desktop
• Process Mining
• Power Automate Mobile App
• Translation Quality Feedback
• Connector Development
• Power Platform Integration - Better Together!
• Power Platform Integrations (Read Only)
• Power Platform and Dynamics 365 Integrations (Read Only)
• Community Connections & How-To Videos
• Webinars and Video Gallery
• Power Automate Cookbook
• 2021 MSBizAppsSummit Gallery
• 2020 MSBizAppsSummit Gallery
• 2019 MSBizAppsSummit Gallery
• Community Blog
• Power Automate Community Blog
• Community Support
• Community Accounts & Registration
• Using the Community
• Community Feedback

Report on App Role Assignments

• Subscribe to RSS Feed
• Mark Topic as New
• Mark Topic as Read
• Float this Topic for Current User
• Printer Friendly Page
• All forum topics
• Previous Topic

• Mark as New
• Report Inappropriate Content

Solved! Go to Solution.

• Process Advisor

View solution in original post

Helpful resources

Super User of the Month | Ahmed Salih

We're thrilled to announce that Ahmed Salih is our Super User of the Month for April 2024. Ahmed has been one of our most active Super Users this year--in fact, he kicked off the year in our Community with this great video reminder of why being a Super User has been so important to him!   Ahmed is the Senior Power Platform Architect at Saint Jude's Children's Research Hospital in Memphis. He's been a Super User for two seasons and is also a Microsoft MVP! He's celebrating his 3rd year being active in the Community--and he's received more than 500 kudos while authoring nearly 300 solutions. Ahmed's contributions to the Super User in Training program has been invaluable, with his most recent session with SUIT highlighting an incredible amount of best practices and tips that have helped him achieve his success.   Ahmed's infectious enthusiasm and boundless energy are a key reason why so many Community members appreciate how he brings his personality--and expertise--to every interaction. With all the solutions he provides, his willingness to help the Community learn more about Power Platform, and his sheer joy in life, we are pleased to celebrate Ahmed and all his contributions! You can find him in the Community and on LinkedIn. Congratulations, Ahmed--thank you for being a SUPER user!

Tuesday Tip: Getting Started with Private Messages & Macros

Welcome to TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   This Week's Tip: Private Messaging & Macros in Power Apps Community   Do you want to enhance your communication in the Community and streamline your interactions? One of the best ways to do this is to ensure you are using Private Messaging--and the ever-handy macros that are available to you as a Community member!   Our Knowledge Base article about private messaging and macros is the best place to find out more. Check it out today and discover some key tips and tricks when it comes to messages and macros:   Private Messaging: Learn how to enable private messages in your community profile and ensure you’re connected with other community membersMacros Explained: Discover the convenience of macros—prewritten text snippets that save time when posting in forums or sending private messagesCreating Macros: Follow simple steps to create your own macros for efficient communication within the Power Apps CommunityUsage Guide: Understand how to apply macros in posts and private messages, enhancing your interaction with the Community For detailed instructions and more information, visit the full page in your community today:Power Apps: Enabling Private Messaging & How to Use Macros (Power Apps)Power Automate: Enabling Private Messaging & How to Use Macros (Power Automate)  Copilot Studio: Enabling Private Messaging &How to Use Macros (Copilot Studio) Power Pages: Enabling Private Messaging & How to Use Macros (Power Pages)

Tuesday Tip: Subscriptions & Notifications

TUESDAY TIPS are our way of communicating helpful things we've learned or shared that have helped members of the Community. Whether you're just getting started or you're a seasoned pro, Tuesday Tips will help you know where to go, what to look for, and navigate your way through the ever-growing--and ever-changing--world of the Power Platform Community! We cover basics about the Community, provide a few "insider tips" to make your experience even better, and share best practices gleaned from our most active community members and Super Users.   With so many new Community members joining us each week, we'll also review a few of our "best practices" so you know just "how" the Community works, so make sure to watch the News & Announcements each week for the latest and greatest Tuesday Tips!   This Week: All About Subscriptions & Notifications We don't want you to a miss a thing in the Community! The best way to make sure you know what's going on in the News & Announcements, to blogs you follow, or forums and galleries you're interested in is to subscribe! These subscriptions ensure you receive automated messages about the most recent posts and replies. Even better, there are multiple ways you can subscribe to content and boards in the community! (Please note: if you have created an AAD (Azure Active Directory) account you won't be able to receive e-mail notifications.)   Subscribing to a Category  When you're looking at the entire category, select from the Options drop down and choose Subscribe.     You can then choose to Subscribe to all of the boards or select only the boards you want to receive notifications. When you're satisfied with your choices, click Save.     Subscribing to a Topic You can also subscribe to a single topic by clicking Subscribe from the Options drop down menu, while you are viewing the topic or in the General board overview, respectively.     Subscribing to a Label Find the labels at the bottom left of a post.From a particular post with a label, click on the label to filter by that label. This opens a window containing a list of posts with the label you have selected. Click Subscribe.     Note: You can only subscribe to a label at the board level. If you subscribe to a label named 'Copilot' at board #1, it will not automatically subscribe you to an identically named label at board #2. You will have to subscribe twice, once at each board.   Bookmarks Just like you can subscribe to topics and categories, you can also bookmark topics and boards from the same menus! Simply go to the Topic Options drop down menu to bookmark a topic or the Options drop down to bookmark a board. The difference between subscribing and bookmarking is that subscriptions provide you with notifications, whereas bookmarks provide you a static way of easily accessing your favorite boards from the My subscriptions area.   Managing & Viewing Your Subscriptions & Bookmarks To manage your subscriptions, click on your avatar and select My subscriptions from the drop-down menu.     From the Subscriptions & Notifications tab, you can manage your subscriptions, including your e-mail subscription options, your bookmarks, your notification settings, and your email notification format.     You can see a list of all your subscriptions and bookmarks and choose which ones to delete, either individually or in bulk, by checking multiple boxes.     A Note on Following Friends on Mobile Adding someone as a friend or selecting Follow in the mobile view does not allow you to subscribe to their activity feed. You will merely be able to see your friends’ biography, other personal information, or online status, and send messages more quickly by choosing who to send the message to from a list, as opposed to having to search by username.

Monthly Community User Group Update | April 2024

The monthly Community User Group Update is your resource for discovering User Group meetings and events happening around the world (and virtually), welcoming new User Groups to our Community, and more! Our amazing Community User Groups are an important part of the Power Platform Community, with more than 700 Community User Groups worldwide, we know they're a great way to engage personally, while giving our members a place to learn and grow together.   This month, we welcome 3 new User Groups in India, Wales, and Germany, and feature 8 User Group Events across Power Platform and Dynamics 365. Find out more below. New Power Platform User Groups   Power Platform Innovators (India) About: Our aim is to foster a collaborative environment where we can share upcoming Power Platform events, best practices, and valuable content related to Power Platform. Whether you’re a seasoned expert or a newcomer looking to learn, this group is for you. Let’s empower each other to achieve more with Power Platform. Join us in shaping the future of digital transformation!   Power Platform User Group (Wales) About: A Power Platform User Group in Wales (predominantly based in Cardiff but will look to hold sessions around Wales) to establish a community to share learnings and experience in all parts of the platform.   Power Platform User Group (Hannover) About: This group is for anyone who works with the services of Microsoft Power Platform or wants to learn more about it and no-code/low-code. And, of course, Microsoft Copilot application in the Power Platform.   New Dynamics365 User Groups   Ellucian CRM Recruit UK (United Kingdom) About: A group for United Kingdom universities using Ellucian CRM Recruit to manage their admissions process, to share good practice and resolve issues.    Business Central Mexico (Mexico City) About:  A place to find documentation, learning resources, and events focused on user needs in Mexico. We meet to discuss and answer questions about the current features in the standard localization that Microsoft provides, and what you only find in third-party locations. In addition, we focus on what's planned for new standard versions, recent legislation requirements, and more. Let's work together to drive request votes for Microsoft for features that aren't currently found—but are indispensable.   Dynamics 365 F&O User Group (Dublin) About: The Dynamics 365 F&O User Group - Ireland Chapter meets up in person at least twice yearly in One Microsoft Place Dublin for users to have the opportunity to have conversations on mutual topics, find out what’s new and on the Dynamics 365 FinOps Product Roadmap, get insights from customer and partner experiences, and access to Microsoft subject matter expertise.  Upcoming Power Platform Events    PAK Time (Power Apps Kwentuhan) 2024 #6 (Phillipines, Online) This is a continuation session of Custom API. Sir Jun Miano will be sharing firsthand experience on setting up custom API and best practices. (April 6, 2024)       Power Apps: Creating business applications rapidly (Sydney) At this event, learn how to choose the right app on Power Platform, creating a business application in an hour, and tips for using Copilot AI. While we recommend attending all 6 events in the series, each session is independent of one another, and you can join the topics of your interest. Think of it as a “Hop On, Hop Off” bus! Participation is free, but you need a personal computer (laptop) and we provide the rest. We look forward to seeing you there! (April 11, 2024)     April 2024 Cleveland Power Platform User Group (Independence, Ohio) Kickoff the meeting with networking, and then our speaker will share how to create responsive and intuitive Canvas Apps using features like Variables, Search and Filtering. And how PowerFx rich functions and expressions makes configuring those functionalities easier. Bring ideas to discuss and engage with other community members! (April 16, 2024)     Dynamics 365 and Power Platform 2024 Wave 1 Release (NYC, Online) This session features Aric Levin, Microsoft Business Applications MVP and Technical Architect at Avanade and Mihir Shah, Global CoC Leader of Microsoft Managed Services at IBM. We will cover some of the new features and enhancements related to the Power Platform, Dataverse, Maker Portal, Unified Interface and the Microsoft First Party Apps (Microsoft Dynamics 365) that were announced in the Microsoft Dynamics 365 and Power Platform 2024 Release Wave 1 Plan. (April 17, 2024)     Let’s Explore Copilot Studio Series: Bot Skills to Extend Your Copilots (Makati National Capital Reg... Join us for the second installment of our Let's Explore Copilot Studio Series, focusing on Bot Skills. Learn how to enhance your copilot's abilities to automate tasks within specific topics, from booking appointments to sending emails and managing tasks. Discover the power of Skills in expanding conversational capabilities. (April 30, 2024)   Upcoming Dynamics365 Events    Leveraging Customer Managed Keys (CMK) in Dynamics 365 (Noida, Uttar Pradesh, Online) This month's featured topic: Leveraging Customer Managed Keys (CMK) in Dynamics 365, with special guest Nitin Jain from Microsoft. We are excited and thankful to him for doing this session. Join us for this online session, which should be helpful to all Dynamics 365 developers, Technical Architects and Enterprise architects who are implementing Dynamics 365 and want to have more control on the security of their data over Microsoft Managed Keys. (April 11, 2024)       Stockholm D365 User Group April Meeting (Stockholm) This is a Swedish user group for D365 Finance and Operations, AX2012, CRM, CE, Project Operations, and Power BI.  (April 17, 2024)         Transportation Management in D365 F&SCM Q&A Session (Toronto, Online) Calling all Toronto UG members and beyond! Join us for an engaging and informative one-hour Q&A session, exclusively focused on Transportation Management System (TMS) within Dynamics 365 F&SCM. Whether you’re a seasoned professional or just curious about TMS, this event is for you. Bring your questions! (April 26, 2024)   Leaders, Create Your Events!    Leaders of existing User Groups, don’t forget to create your events within the Community platform. By doing so, you’ll enable us to share them in future posts and newsletters. Let’s spread the word and make these gatherings even more impactful! Stay tuned for more updates, inspiring stories, and collaborative opportunities from and for our Community User Groups.   P.S. Have an event or success story to share? Reach out to us – we’d love to feature you. Just leave a comment or send a PM here in the Community!

Exclusive LIVE Community Event: Power Apps Copilot Coffee Chat with Copilot Studio Product Team

We have closed kudos on this post at this time. Thank you to everyone who kudo'ed their RSVP--your invitations are coming soon!  Miss the window to RSVP? Don't worry--you can catch the recording of the meeting this week in the Community.  Details coming soon!   *****   It's time for the SECOND Power Apps Copilot Coffee Chat featuring the Copilot Studio product team, which will be held LIVE on April 3, 2024 at 9:30 AM Pacific Daylight Time (PDT).     This is an incredible opportunity to connect with members of the Copilot Studio product team and ask them anything about Copilot Studio. We'll share our special guests with you shortly--but we want to encourage to mark your calendars now because you will not want to miss the conversation.   This live event will give you the unique opportunity to learn more about Copilot Studio plans, where we’ll focus, and get insight into upcoming features. We’re looking forward to hearing from the community, so bring your questions!   TO GET ACCESS TO THIS EXCLUSIVE AMA: Kudo this post to reserve your spot! Reserve your spot now by kudoing this post.  Reservations will be prioritized on when your kudo for the post comes through, so don't wait! Click that "kudo button" today.   Invitations will be sent on April 2nd.Users posting Kudos after April 2nd at 9AM PDT may not receive an invitation but will be able to view the session online after conclusion of the event. Give your "kudo" today and mark your calendars for April 3, 2024 at 9:30 AM PDT and join us for an engaging and informative session!

Tuesday Tip: Blogging in the Community is a Great Way to Start

TUESDAY TIPS are our way of communicating helpful things we've learned or shared that have helped members of the Community. Whether you're just getting started or you're a seasoned pro, Tuesday Tips will help you know where to go, what to look for, and navigate your way through the ever-growing--and ever-changing--world of the Power Platform Community! We cover basics about the Community, provide a few "insider tips" to make your experience even better, and share best practices gleaned from our most active community members and Super Users.   With so many new Community members joining us each week, we'll also review a few of our "best practices" so you know just "how" the Community works, so make sure to watch the News & Announcements each week for the latest and greatest Tuesday Tips!   This Week's Topic: Blogging in the Community Are you new to our Communities and feel like you may know a few things to share, but you're not quite ready to start answering questions in the forums? A great place to start is the Community blog! Whether you've been using Power Platform for awhile, or you're new to the low-code revolution, the Community blog is a place for anyone who can write, has some great insight to share, and is willing to commit to posting regularly! In other words, we want YOU to join the Community blog.    Why should you consider becoming a blog author? Here are just a few great reasons. 🎉   Learn from Each Other: Our community is like a bustling marketplace of ideas. By sharing your experiences and insights, you contribute to a dynamic ecosystem where makers learn from one another. Your unique perspective matters! Collaborate and Innovate: Imagine a virtual brainstorming session where minds collide, ideas spark, and solutions emerge. That’s what our community blog offers—a platform for collaboration and innovation. Together, we can build something extraordinary. Showcase the Power of Low-Code: You know that feeling when you discover a hidden gem? By writing about your experience with your favorite Power Platform tool, you’re shining a spotlight on its capabilities and real-world applications. It’s like saying, “Hey world, check out this amazing tool!” Earn Trust and Credibility: When you share valuable information, you become a trusted resource. Your fellow community members rely on your tips, tricks, and know-how. It’s like being the go-to friend who always has the best recommendations. Empower Others: By contributing to our community blog, you empower others to level up their skills. Whether it’s a nifty workaround, a time-saving hack, or an aha moment, your words have impact. So grab your keyboard, brew your favorite beverage, and start writing! Your insights matter and your voice counts! With every blog shared in the Community, we all do a better job of tackling complex challenges with gusto. 🚀 Welcome aboard, future blog author! ✍️💻🌟 Get started blogging across the Power Platform Communities today! Just follow one of the links below to begin your blogging adventure.   Power Apps: https://powerusers.microsoft.com/t5/Power-Apps-Community-Blog/bg-p/PowerAppsBlog Power Automate: https://powerusers.microsoft.com/t5/Power-Automate-Community-Blog/bg-p/MPABlog Copilot Studio: https://powerusers.microsoft.com/t5/Copilot-Studio-Community-Blog/bg-p/PVACommunityBlog Power Pages: https://powerusers.microsoft.com/t5/Power-Pages-Community-Blog/bg-p/mpp_blog   When you follow the link, look for the Message Admins button like this on the page's right rail, and let us know you're interested. We can't wait to connect with you and help you get started. Thanks for being part of our incredible community--and thanks for becoming part of the community blog!

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Understand Azure role assignments

• 3 contributors

Role assignments enable you to grant a principal (such as a user, a group, a managed identity, or a service principal) access to a specific Azure resource. This article describes the details of role assignments.

Role assignment

Access to Azure resources is granted by creating a role assignment, and access is revoked by removing a role assignment.

A role assignment has several components, including:

• The principal , or who is assigned the role.
• The role that they're assigned.
• The scope at which the role is assigned.
• The name of the role assignment, and a description that helps you to explain why the role has been assigned.

For example, you can use Azure RBAC to assign roles like:

• User Sally has owner access to the storage account contoso123 in the resource group ContosoStorage .
• Everybody in the Cloud Administrators group in Microsoft Entra ID has reader access to all resources in the resource group ContosoStorage .
• The managed identity associated with an application is allowed to restart virtual machines within Contoso's subscription.

The following shows an example of the properties in a role assignment when displayed using Azure PowerShell :

The following shows an example of the properties in a role assignment when displayed using the Azure CLI , or the REST API :

The following table describes what the role assignment properties mean.

When you create a role assignment, you need to specify the scope at which it's applied. The scope represents the resource, or set of resources, that the principal is allowed to access. You can scope a role assignment to a single resource, a resource group, a subscription, or a management group.

Use the smallest scope that you need to meet your requirements.

For example, if you need to grant a managed identity access to a single storage account, it's good security practice to create the role assignment at the scope of the storage account, not at the resource group or subscription scope.

For more information about scope, see Understand scope .

Role to assign

A role assignment is associated with a role definition. The role definition specifies the permissions that the principal should have within the role assignment's scope.

You can assign a built-in role definition or a custom role definition. When you create a role assignment, some tooling requires that you use the role definition ID while other tooling allows you to provide the name of the role.

For more information about role definitions, see Understand role definitions .

Principals include users, security groups, managed identities, workload identities, and service principals. Principals are created and managed in your Microsoft Entra tenant. You can assign a role to any principal. Use the Microsoft Entra ID object ID to identify the principal that you want to assign the role to.

When you create a role assignment by using Azure PowerShell, the Azure CLI, Bicep, or another infrastructure as code (IaC) technology, you specify the principal type . Principal types include User , Group , and ServicePrincipal . It's important to specify the correct principal type. Otherwise, you might get intermittent deployment errors, especially when you work with service principals and managed identities.

A role assignment's resource name must be a globally unique identifier (GUID).

Role assignment resource names must be unique within the Microsoft Entra tenant, even if the scope of the role assignment is narrower.

When you create a role assignment by using the Azure portal, Azure PowerShell, or the Azure CLI, the creation process gives the role assignment a unique name for you automatically.

If you create a role assignment by using Bicep or another infrastructure as code (IaC) technology, you need to carefully plan how you name your role assignments. For more information, see Create Azure RBAC resources by using Bicep .

Resource deletion behavior

When you delete a user, group, service principal, or managed identity from Microsoft Entra ID, it's a good practice to delete any role assignments. They aren't deleted automatically. Any role assignments that refer to a deleted principal ID become invalid.

If you try to reuse a role assignment's name for another role assignment, the deployment will fail. This issue is more likely to occur when you use Bicep or an Azure Resource Manager template (ARM template) to deploy your role assignments, because you have to explicitly set the role assignment name when you use these tools. To work around this behavior, you should either remove the old role assignment before you recreate it, or ensure that you use a unique name when you deploy a new role assignment.

Description

You can add a text description to a role assignment. While descriptions are optional, it's a good practice to add them to your role assignments. Provide a short justification for why the principal needs the assigned role. When somebody audits the role assignments, descriptions can help to understand why they've been created and whether they're still applicable.

Some roles support role assignment conditions based on attributes in the context of specific actions. A role assignment condition is an additional check that you can optionally add to your role assignment to provide more fine-grained access control.

For example, you can add a condition that requires an object to have a specific tag for the user to read the object.

You typically build conditions using a visual condition editor, but here's what an example condition looks like in code:

The preceding condition allows users to read blobs with a blob index tag key of Project and a value of Cascade .

For more information about conditions, see What is Azure attribute-based access control (Azure ABAC)?

• Delegate Azure access management to others
• Steps to assign an Azure role

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources