Skip to content

[Feature Request] az role assignment list/delete: Support --assignee-object-id #30436

@jiasli

Description

@jiasli

Related command
az role assignment list
az role assignment delete

Is your feature request related to a problem? Please describe.
#5273 added --assignee-object-id to az role assignment create to bypass the Microsoft Graph query, but --assignee-object-id is not added to az role assignment list and az role assignment delete. These commands still require resolving --assignee via Microsoft Graph.

If the logged-in account does not have permission to query Microsoft Graph, CLI can still recover and treat the provided ID as object ID:

except GraphError:
logger.warning('Failed to query %s by invoking Graph API. '
'If you don\'t have permission to query Graph API, please '
'specify --assignee-object-id and --assignee-principal-type.', assignee)
if fallback_to_object_id and is_guid(assignee):
logger.warning('Assuming %s as an object ID.', assignee)
return assignee, None
raise

But, if CLI has no network connection to Microsoft Graph endpoint or fails to get an access token for Microsoft Graph (#30428), it has no way to recover.

With more encouragement on managed identity and more strict permission/access control, supporting --assignee-object-id to bypass Graph query is a necessary feature for role assignment’s management experience.

Describe the solution you'd like
az role assignment list and az role assignment delete should support --assignee-object-id like az role assignment create, in order to fully bypass Microsoft Graph query.

Describe alternatives you've considered

Additional context

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions