Skip to main content

deny_assignments

Creates, updates, deletes, gets or lists a deny_assignments resource.

Overview​

Namedeny_assignments
TypeResource
Idazure.authorization.deny_assignments

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
idstringFully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
namestringThe name of the resource.
conditionstringThe conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'.
conditionVersionstringVersion of the condition.
createdBystringId of the user who created the assignment.
createdOnstring (date-time)Time it was created.
denyAssignmentEffectstringThe effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking. Known values are: "enforced" and "audit". (enforced, audit)
denyAssignmentNamestringThe display name of the deny assignment.
descriptionstringThe description of the deny assignment.
doNotApplyToChildScopesbooleanDetermines if the deny assignment applies to child scopes. Default value is false.
excludePrincipalsarrayArray of principals to which the deny assignment does not apply.
isSystemProtectedbooleanSpecifies whether this deny assignment was created by Azure and cannot be edited or deleted.
permissionsarrayAn array of permissions that are denied by the deny assignment.
principalsarrayArray of principals to which the deny assignment applies.
scopestringThe deny assignment scope.
systemDataobjectAzure Resource Manager metadata containing createdBy and modifiedBy information.
typestringThe type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updatedBystringId of the user who updated the assignment.
updatedOnstring (date-time)Time it was updated.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
list_for_resourceselectresource_group_name, resource_provider_namespace, parent_resource_path, resource_type, resource_name, subscription_id$filterGets deny assignments for a resource.
getselectscope, deny_assignment_idGet the specified deny assignment.
list_for_resource_groupselectresource_group_name, subscription_id$filterGets deny assignments for a resource group.
listselectsubscription_id$filterGets all deny assignments for the subscription.
list_for_scopeselectscope$filterGets deny assignments for a scope.
get_by_idselectdeny_assignment_idGets a deny assignment by ID.
create_or_updateinsertscope, deny_assignment_idCreate or update a deny assignment by scope and name.
create_or_updatereplacescope, deny_assignment_idCreate or update a deny assignment by scope and name.
deletedeletescope, deny_assignment_idDelete a deny assignment by scope and name.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
deny_assignment_idstringThe ID of the deny assignment to get. Required.
parent_resource_pathstringThe parent resource identity. Required.
resource_group_namestringThe name of the resource group. The name is case insensitive. Required.
resource_namestringThe name of the resource to get deny assignments for. Required.
resource_provider_namespacestringThe namespace of the resource provider. Required.
resource_typestringThe resource type of the resource. Required.
scopestringThe fully qualified Azure Resource manager identifier of the resource. Required.
subscription_idstring
$filterstringThe filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use $filter=denyAssignmentName eq '{name}' to search deny assignments by name at specified scope. Use $filter=principalId eq '{id}' to return all deny assignments at, above and below the scope for the specified principal. Use $filter=gdprExportPrincipalId eq '{id}' to return all deny assignments at, above and below the scope for the specified principal. This filter is different from the principalId filter as it returns not only those deny assignments that contain the specified principal is the Principals list but also those deny assignments that contain the specified principal is the ExcludePrincipals list. Additionally, when gdprExportPrincipalId filter is used, only the deny assignment name and description properties are returned. Default value is None.

SELECT examples​

Gets deny assignments for a resource.

SELECT
id,
name,
condition,
conditionVersion,
createdBy,
createdOn,
denyAssignmentEffect,
denyAssignmentName,
description,
doNotApplyToChildScopes,
excludePrincipals,
isSystemProtected,
permissions,
principals,
scope,
systemData,
type,
updatedBy,
updatedOn
FROM azure.authorization.deny_assignments
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND resource_provider_namespace = '{{ resource_provider_namespace }}' -- required
AND parent_resource_path = '{{ parent_resource_path }}' -- required
AND resource_type = '{{ resource_type }}' -- required
AND resource_name = '{{ resource_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

INSERT examples​

Create or update a deny assignment by scope and name.

INSERT INTO azure.authorization.deny_assignments (
properties,
scope,
deny_assignment_id
)
SELECT 
'{{ properties }}',
'{{ scope }}',
'{{ deny_assignment_id }}'
RETURNING
id,
name,
properties,
systemData,
type
;

REPLACE examples​

Create or update a deny assignment by scope and name.

REPLACE azure.authorization.deny_assignments
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND deny_assignment_id = '{{ deny_assignment_id }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples​

Delete a deny assignment by scope and name.

DELETE FROM azure.authorization.deny_assignments
WHERE scope = '{{ scope }}' --required
AND deny_assignment_id = '{{ deny_assignment_id }}' --required
;