azurerolesazure-clirbac

Azure won't show roleDefinition for directory roles

I'm using the following API, it works with regular roles such as "Reader":"acdd72a7-3385-48ef-bd42-f606fba81ae7".

az rest --method get --url 'https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7?api-version=2022-04-01'

However it won't work with directory roles such as this https://www.azadvertizer.net/azentraidroles/e8611ab8-c189-46e8-94e1-60213ab1f814.html

az rest `
    --method get `
    --url "https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions?`$filter=roleName+eq+'Privileged Role Administrator'&api-version=2022-04-01"
# nothing 

az rest --method get --url 'https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/e8611ab8-c189-46e8-94e1-60213ab1f814?api-version=2022-04-01'
# Not Found({"error":{"code":"RoleDefinitionDoesNotExist","message":"The specified role definition with ID 'e8611ab8-c189-46e8-94e1-60213ab1f814' does not exist."}})

The query will always return an empty value. How can I list the roleDefinition and data actions for such a role?

Solution

  • You can only retrieve Azure RBAC roles via ARM’s /roleDefinitions endpoint. Initially, I too got same results:

    az rest `
    --method get `
    --url "https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions?`$filter=roleName+eq+'Privileged Role Administrator'&api-version=2022-04-01"

az rest --method get --url 'https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/e8611ab8-c189-46e8-94e1-60213ab1f814?api-version=2022-04-01'

    enter image description here

    Instead, call Microsoft Graph’s roleManagement/directory API to fetch unified directory roles and their permissions.

    To retrieve Privileged Role Administrator role definition, make use of below call:

    az rest --method GET --uri 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions?$filter=displayName eq ''Privileged Role Administrator'''

    enter image description here

    Reference:

    Get unifiedRoleDefinition - Microsoft Graph