-
Notifications
You must be signed in to change notification settings - Fork 3.3k
Description
Related command
az role assignment list
az role assignment delete
Is your feature request related to a problem? Please describe.
#5273 added --assignee-object-id to az role assignment create to bypass the Microsoft Graph query, but --assignee-object-id is not added to az role assignment list and az role assignment delete. These commands still require resolving --assignee via Microsoft Graph.
If the logged-in account does not have permission to query Microsoft Graph, CLI can still recover and treat the provided ID as object ID:
azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py
Lines 1569 to 1576 in f76cfd2
| except GraphError: | |
| logger.warning('Failed to query %s by invoking Graph API. ' | |
| 'If you don\'t have permission to query Graph API, please ' | |
| 'specify --assignee-object-id and --assignee-principal-type.', assignee) | |
| if fallback_to_object_id and is_guid(assignee): | |
| logger.warning('Assuming %s as an object ID.', assignee) | |
| return assignee, None | |
| raise |
But, if CLI has no network connection to Microsoft Graph endpoint or fails to get an access token for Microsoft Graph (#30428), it has no way to recover.
With more encouragement on managed identity and more strict permission/access control, supporting --assignee-object-id to bypass Graph query is a necessary feature for role assignment’s management experience.
Describe the solution you'd like
az role assignment list and az role assignment delete should support --assignee-object-id like az role assignment create, in order to fully bypass Microsoft Graph query.
Describe alternatives you've considered
Additional context