azureazure-rbacazure-python-sdk

Get all users and applications with Reader role under subscription in Azure Python SDK

I need to fetch users and applications assigned the "Reader" role under a specific Azure subscription using the Azure Python SDK. The AuthorizationManagementClient is being used along with the role_assignments.list_for_scope() method to list role assignments, but an issue arises with the filter query.

Here’s the code that’s being used:

from azure.identity import ClientSecretCredential
from azure.mgmt.authorization import AuthorizationManagementClient

scope = f"subscriptions/{subscription_id}"
reader_role_definition_id = "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7"

credential = ClientSecretCredential(
    tenant_id=tenant_id,
    client_id=client_id,
    client_secret=client_secret
)
authorization_client = AuthorizationManagementClient(credential, subscription_id)

try:
    print("\nFetching users and applications with 'Reader' role in the subscription...")
    role_assignments = authorization_client.role_assignments.list_for_scope(
        scope=scope,
        filter=f"atScope() and roleDefinitionId eq '{reader_role_definition_id}'"
    )

    print("Users or applications with Reader Role:")
    for assignment in role_assignments:
        print(f"Principal ID: {assignment.principal_id}")
except Exception as e:
    print("Failed to fetch users or applications with 'Reader' role:", str(e))

However, upon executing the code, I receive following error message:

Fetching users and applications with 'Reader' role in the subscription...
Users or applications with Reader Role:
Failed to fetch users or applications with 'Reader' role: (UnsupportedQuery) The filter 'atScope() and roleDefinitionId eq '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7'' is not supported. Supported filters are either 'atScope()' or 'principalId eq '{value}' or assignedTo('{value}')'.
Code: UnsupportedQuery
Message: The filter 'atScope() and roleDefinitionId eq '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7'' is not supported. Supported filters are either 'atScope()' or 'principalId eq '{value}' or assignedTo('{value}')'.
Solution

  • The error occurred as filtering on roleDefinitionId property is not supported. The supported values of $filter query parameter are atScope() or principalId eq '{value}' or assignedTo('{value}')

    I have below users and applications with Reader role assigned under subscription:

    enter image description here

    To fetch these details using Azure Python SDK, you can make use of below sample code:

    from azure.mgmt.authorization import AuthorizationManagementClient
from azure.identity import ClientSecretCredential

tenant_id = "tenantId"
client_id = "appId"
client_secret = "secret"
subscription_id = "subId"

credentials = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)
authorization_client = AuthorizationManagementClient(credentials, subscription_id)

def list_readers(client):
    results = []
    subscription_scope = f'/subscriptions/{subscription_id}'
    reader_role_id = 'acdd72a7-3385-48ef-bd42-f606fba81ae7'
    roles = client.role_assignments.list_for_scope(scope=subscription_scope, filter='atScope()')
    for role in roles:
        if reader_role_id in role.role_definition_id:
            results.append({
                "principal_id": role.principal_id,
                "principal_type": role.principal_type
            })
    return results

try:
    readers = list_readers(authorization_client)
    for reader in readers:
        print(f"Principal ID: {reader['principal_id']}, Principal Type: {reader['principal_type']}")
except Exception as e:
    print("Failed to fetch users or applications with 'Reader' role:", str(e))

    Response:

    enter image description here