azureazure-active-directoryazure-cli

Why Can't I See Roles Assigned to an App Registration in Azure?

I created an Azure App Registration using the following command:

az ad sp create-for-rbac --name "my-app"

I assigned a role to it using:

az role assignment create --assignee <APP_ID> --role "Reader" --scope /subscriptions/<SUBSCRIPTION_ID>

I also deleted some roles using:

az role assignment delete --assignee <APP_ID> --role "Reader" --scope /subscriptions/<SUBSCRIPTION_ID>

However, when I try to list the roles assigned to the app registration using any of the following:

None of them return any results.

What I've Tried:

  1. Confirmed that the Application ID, Object ID, and app name are correct and match the app registration details.

Questions:

  1. How can I reliably view the roles assigned to my app registration?
  2. Are there any other commands or troubleshooting steps to debug this issue?

Any guidance would be greatly appreciated!

Solution

  • Registered an application using below CLI command:

    az ad sp create-for-rbac --name "<application-name>"

    enter image description here

    Note: Ensure you should have active Subscription and sufficient permission like (Owner or User Access Administrator) role assigned on the scope(i.e Subscription Level) where you want to assign the role.

    Assigned Reader role to application at the scope of Subscription Level:

    az role assignment create --assignee <APP_ID> --role "Reader" --scope /subscriptions/<SUBSCRIPTION_ID>

    enter image description here

    After assigning the Reader role to application, I've verified this same from Azure Portal under Access Control (IAM) tab of Subscription as well.

    enter image description here

    After verifying from above, I try to list the roles assigned to application using below Azure CLI command:

    az role assignment list --assignee <Application-id or Object-Id of application>

    enter image description here

    UPDATE:

    To list the all role assignment under your subscription:

    az role assignment list --all

    enter image description here

    If still issue persist, reassign the Reader role to registered application and run the CLI command for listing the roles assigned to application

    Reference:

    az role assignment list