Skip to main content

role_assignments

Creates, updates, deletes, gets or lists a role_assignments resource.

Overview​

Namerole_assignments
TypeResource
Idazure.authorization.role_assignments

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
idstringFully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
namestringThe name of the resource.
conditionstringThe conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'.
conditionVersionstringVersion of the condition. Currently the only accepted value is '2.0'.
createdBystringId of the user who created the assignment.
createdOnstring (date-time)Time it was created.
delegatedManagedIdentityResourceIdstringId of the delegated managed identity resource.
descriptionstringDescription of role assignment.
principalIdstringThe principal ID. Required.
principalTypestringThe principal type of the assigned principal ID. Known values are: "User", "Group", "ServicePrincipal", "ForeignGroup", and "Device". (User, Group, ServicePrincipal, ForeignGroup, Device)
roleDefinitionIdstringThe role definition ID. Required.
scopestringThe role assignment scope.
systemDataobjectAzure Resource Manager metadata containing createdBy and modifiedBy information.
typestringThe type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updatedBystringId of the user who updated the assignment.
updatedOnstring (date-time)Time it was updated.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
list_for_resourceselectresource_group_name, resource_provider_namespace, resource_type, resource_name, subscription_id$filter, tenantIdList all role assignments that apply to a resource.
getselectscope, role_assignment_nametenantIdGet a role assignment by scope and name.
list_for_resource_groupselectresource_group_name, subscription_id$filter, tenantIdList all role assignments that apply to a resource group.
list_for_scopeselectscope$filter, tenantId, $skipTokenList all role assignments that apply to a scope.
list_for_subscriptionselectsubscription_id$filter, tenantIdList all role assignments that apply to a subscription.
get_by_idselectrole_assignment_idtenantIdGet a role assignment by ID.
createinsertscope, role_assignment_name, propertiesCreate or update a role assignment by scope and name.
create_by_idinsertrole_assignment_id, propertiesCreate or update a role assignment by ID.
deletedeletescope, role_assignment_nametenantIdDelete a role assignment by scope and name.
delete_by_iddeleterole_assignment_idtenantIdDelete a role assignment by ID.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
resource_group_namestringThe name of the resource group. The name is case insensitive. Required.
resource_namestringThe name of the resource to get role assignments for. Required.
resource_provider_namespacestringThe namespace of the resource provider. Required.
resource_typestringThe resource type of the resource. Required.
role_assignment_idstringThe fully qualified ID of the role assignment including scope, resource name, and resource type. Format: /{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}. Example: /subscriptions//resourcegroups//providers/Microsoft.Authorization/roleAssignments/. Required.
role_assignment_namestringThe name of the role assignment. It can be any valid GUID. Required.
scopestringThe fully qualified Azure Resource manager identifier of the resource. Required.
subscription_idstring
$filterstringThe filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope for the specified principal. Default value is None.
$skipTokenstringThe skipToken to apply on the operation. Use $skipToken={skiptoken} to return paged role assignments following the skipToken passed. Only supported on provider level calls. Default value is None.
tenantIdstringTenant ID for cross-tenant request. Default value is None.

SELECT examples​

List all role assignments that apply to a resource.

SELECT
id,
name,
condition,
conditionVersion,
createdBy,
createdOn,
delegatedManagedIdentityResourceId,
description,
principalId,
principalType,
roleDefinitionId,
scope,
systemData,
type,
updatedBy,
updatedOn
FROM azure.authorization.role_assignments
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND resource_provider_namespace = '{{ resource_provider_namespace }}' -- required
AND resource_type = '{{ resource_type }}' -- required
AND resource_name = '{{ resource_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
AND tenantId = '{{ tenantId }}'
;

INSERT examples​

Create or update a role assignment by scope and name.

INSERT INTO azure.authorization.role_assignments (
properties,
scope,
role_assignment_name
)
SELECT 
'{{ properties }}' /* required */,
'{{ scope }}',
'{{ role_assignment_name }}'
RETURNING
id,
name,
properties,
systemData,
type
;

DELETE examples​

Delete a role assignment by scope and name.

DELETE FROM azure.authorization.role_assignments
WHERE scope = '{{ scope }}' --required
AND role_assignment_name = '{{ role_assignment_name }}' --required
AND tenantId = '{{ tenantId }}'
;