azurepowershellmicrosoft365-defender

Export all Azure/Defender/Subscription/Exchange roles/members

My goal is to compare the different roles/permissions as it pertains to user memberships for our Azure/M365 environment. This would include Azure / EOL / Defender and if possible, at the subscriptions as well. Not sure if I have missed any places for Tenant/Service level permissions, if I have I would want those as well...

I have just started this process and have not been able to locate any comprehensive solution.

Solution

  • To list all the Subscription Roles, use below command:

    Connect-AzAccount
Get-AzRoleDefinition | FT Name, Description

    enter image description here

    To get Subscription Roles and Members, use the below script:

    Connect-AzAccount

$roleAssignments = Get-AzRoleAssignment | Select-Object DisplayName, RoleDefinitionName, PrincipalName, Scope
$roleAssignments | Format-Table -AutoSize

    enter image description here

    To list Directory roles, make use of below command:

    Connect-MgGraph 

$directoryRoles = Get-MgDirectoryRole 
$directoryRoles | Select-Object DisplayName, Description

    enter image description here

    To fetch Azure/Directory Roles and Members, use the below script:

    Connect-MgGraph 

$roles = Get-MgDirectoryRole  
foreach ($role in $roles) {  
$roleName = $role.DisplayName  
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id  
$members | ForEach-Object {  
$member = Get-MgUser -UserId $_.Id  
[PSCustomObject]@{  
DisplayName = $member.DisplayName  
UserPrincipalName = $member.UserPrincipalName  
Role = $roleName  
}  
} | Format-Table -AutoSize }

    enter image description here

    To fetch Exchange Online Roles, use the below command:

    Connect-ExchangeOnline
$exchangeRoles = Get-ManagementRoleAssignment
$exchangeRoles

    enter image description here

    References:

    Get-ManagementRole (ExchangePowerShell) | Microsoft

    Get-ManagementRoleAssignment (ExchangePowerShell) | Microsoft