Merge pull request #207611 from rolyon/rolyon-rbac-check-access-update

[Azure RBAC] Check access update

Author: v-regandowner

articles/role-based-access-control/check-access.md

@@ -7,7 +7,7 @@ manager: amycolannino
 ms.service: role-based-access-control
 ms.topic: quickstart
 ms.workload: identity
-ms.date: 12/09/2020
+ms.date: 08/26/2022
 ms.author: rolyon
 ms.custom: contperf-fy21q2, mode-other
 #Customer intent: As a new user, I want to quickly see access for myself, user, group, or application, to make sure they have the appropriate permissions.
@@ -21,19 +21,19 @@ Sometimes you need to check what access a user has to a set of Azure resources.
 
 To check the access for a user, you first need to open the Azure resources you want to check access for. Azure resources are organized into levels that are typically called the *scope*. In Azure, you can specify a scope at four levels from broad to narrow: management group, subscription, resource group, and resource.
 
-![Scope levels for Azure RBAC](../../includes/role-based-access-control/media/scope-levels.png)
+![Diagram that shows scope levels for Azure RBAC.](../../includes/role-based-access-control/media/scope-levels.png)
 
 Follow these steps to open the set of Azure resources that you want to check access for.
 
 1. Open the [Azure portal](https://portal.azure.com).
 
-1. Open the set of Azure resources, such as **Management groups**, **Subscriptions**, **Resource groups**, or a particular resource.
+1. Open the set of Azure resources you want to check access for, such as **Management groups**, **Subscriptions**, **Resource groups**, or a particular resource.
 
 1. Click the specific resource in that scope.
 
     The following shows an example resource group.
 
-    ![Resource group overview](./media/shared/rg-overview.png)
+    ![Screenshot of resource group overview.](./media/shared/rg-overview.png)
 
 ## Step 2: Check access for a user
 
@@ -43,23 +43,25 @@ Follow these steps to check the access for a single user, group, service princip
 
     The following shows an example of the Access control (IAM) page for a resource group.
 
-    ![Resource group access control - Check access tab](./media/shared/rg-access-control.png)
+    ![Screenshot of resource group access control and Check access tab.](./media/shared/rg-access-control.png)
 
-1. On the **Check access** tab, in the **Find** list, select the user, group, service principal, or managed identity you want to check access for.
+1. On the **Check access** tab, click the **Check access** button.
+
+1. In the **Check access** pane, click **User, group, or service principal**.
 
 1. In the search box, enter a string to search the directory for display names, email addresses, or object identifiers.
 
-    ![Check access select list](./media/shared/rg-check-access-select.png)
+    ![Screenshot of Check access select list.](./media/shared/rg-check-access-select.png)
 
-1. Click the security principal to open the **assignments** pane.
+1. Click the user to open the **assignments** pane.
 
-    On this pane, you can see the access for the selected security principal at this scope and inherited to this scope. Assignments at child scopes are not listed. You see the following assignments:
+    On this pane, you can see the access for the selected user at this scope and inherited to this scope. Assignments at child scopes are not listed. You see the following assignments:
 
     - Role assignments added with Azure RBAC.
     - Deny assignments added using Azure Blueprints or Azure managed apps.
     - Classic Service Administrator or Co-Administrator assignments for classic deployments. 
 
-    ![Role and deny assignments pane for a user](./media/shared/rg-check-access-assignments-user.png)
+    ![Screenshot of role and deny assignments pane for a user.](./media/shared/rg-check-access-assignments-user.png)
 
 ## Step 3: Check your access
 
@@ -71,7 +73,7 @@ Follow these steps to check your access to the previously selected Azure resourc
 
     An assignments pane appears that lists your access at this scope and inherited to this scope. Assignments at child scopes are not listed.
 
-    ![Role and deny assignments pane](./media/check-access/rg-check-access-assignments.png)
+    ![Screenshot of role and deny assignments pane.](./media/check-access/rg-check-access-assignments.png)
 
 ## Next steps
 

articles/role-based-access-control/media/role-assignments-list-portal/rg-access-control-check-access.png

@@ -10,7 +10,7 @@ ms.devlang:
 ms.topic: how-to
 ms.tgt_pltfrm:
 ms.workload: identity
-ms.date: 10/15/2021
+ms.date: 08/26/2022
 ms.author: rolyon
 ms.custom: it-pro,subject-rbac-steps
 
@@ -225,7 +225,7 @@ If a guest user has been granted access to a directory, but they do not see the
 
 If a guest user has been granted access to a directory, but they do not see the resources they have been granted access to in the Azure portal, make sure the guest user has selected the correct directory. A guest user might have access to multiple directories. To switch directories, in the upper left, click **Settings** > **Directories**, and then click the appropriate directory.
 
-![Screenshot of Poral setting Directories section in Azure portal.](./media/role-assignments-external-users/directory-switch.png)
+![Screenshot of Portal setting Directories section in Azure portal.](./media/role-assignments-external-users/directory-switch.png)
 
 ## Next steps
 

articles/role-based-access-control/media/shared/rg-access-control.png

@@ -7,7 +7,7 @@ manager: amycolannino
 ms.service: role-based-access-control
 ms.topic: how-to
 ms.workload: identity
-ms.date: 11/12/2021
+ms.date: 08/26/2022
 ms.author: rolyon
 ---
 
@@ -32,7 +32,7 @@ A quick way to see the roles assigned to a user or group in a subscription is to
 
     You see a list of roles assigned to the selected user or group at various scopes such as management group, subscription, resource group, or resource. This list includes all role assignments you have permission to read.
 
-    ![Role assignments for a user](./media/role-assignments-list-portal/azure-role-assignments-user.png)    
+    ![Screenshot of role assignments for a user.](./media/role-assignments-list-portal/azure-role-assignments-user.png)    
 
 1. To change the subscription, click the **Subscriptions** list.
 
@@ -50,7 +50,7 @@ Users that have been assigned the [Owner](built-in-roles.md#owner) role for a su
 
 1. Scroll to the **Owners** section to see all the users that have been assigned the Owner role for this subscription.
 
-   ![Subscription Access control - Role assignments tab](./media/role-assignments-list-portal/sub-access-control-role-assignments-owners.png)
+   ![Screenshot of subscription Access control and Role assignments tab.](./media/role-assignments-list-portal/sub-access-control-role-assignments-owners.png)
 
 ## List role assignments at a scope
 
@@ -62,7 +62,7 @@ Users that have been assigned the [Owner](built-in-roles.md#owner) role for a su
 
 1. Click the **Role assignments** tab to view all the role assignments at this scope.
 
-   ![Access control - Role assignments tab](./media/role-assignments-list-portal/rg-access-control-role-assignments.png)
+   ![Screenshot of Access control and Role assignments tab.](./media/role-assignments-list-portal/rg-access-control-role-assignments.png)
 
    On the Role assignments tab, you can see who has access at this scope. Notice that some roles are scoped to **This resource** while others are **(Inherited)** from another scope. Access is either assigned specifically to this resource or inherited from an assignment to the parent scope.
 
@@ -76,15 +76,15 @@ To list access for a user, group, service principal, or managed identity, you li
 
 1. Click **Access control (IAM)**.
 
-1. Click the **Check access** tab.
+    ![Screenshot of resource group access control and Check access tab.](./media/shared/rg-access-control.png)
 
-    ![Resource group access control - Check access tab](./media/role-assignments-list-portal/rg-access-control-check-access.png)
+1. On the **Check access** tab, click the **Check access** button.
 
-1. In the **Find** list, select the user, group, service principal, or managed identity you want to check access for.
+1. In the **Check access** pane, click **User, group, or service principal** or **Managed identity**.
 
 1. In the search box, enter a string to search the directory for display names, email addresses, or object identifiers.
 
-    ![Check access select list](./media/shared/rg-check-access-select.png)
+    ![Screenshot of Check access select list.](./media/shared/rg-check-access-select.png)
 
 1. Click the security principal to open the **assignments** pane.
 
@@ -94,7 +94,7 @@ To list access for a user, group, service principal, or managed identity, you li
     - Deny assignments added using Azure Blueprints or Azure managed apps.
     - Classic Service Administrator or Co-Administrator assignments for classic deployments. 
 
-    ![assignments pane](./media/shared/rg-check-access-assignments-user.png)
+    ![Screenshot of assignments pane.](./media/shared/rg-check-access-assignments-user.png)
 
 ## List role assignments for a managed identity
 
@@ -106,13 +106,13 @@ You can list role assignments for system-assigned and user-assigned managed iden
 
 1. In the left menu, click **Identity**.
 
-    ![System-assigned managed identity](./media/shared/identity-system-assigned.png)
+    ![Screenshot of system-assigned managed identity.](./media/shared/identity-system-assigned.png)
 
 1. Under **Permissions**, click **Azure role assignments**.
 
     You see a list of roles assigned to the selected system-assigned managed identity at various scopes such as management group, subscription, resource group, or resource. This list includes all role assignments you have permission to read.
 
-    ![Role assignments for a system-assigned managed identity](./media/shared/role-assignments-system-assigned.png)
+    ![Screenshot of role assignments for a system-assigned managed identity.](./media/shared/role-assignments-system-assigned.png)
 
 1. To change the subscription, click the **Subscription** list.
 
@@ -124,7 +124,7 @@ You can list role assignments for system-assigned and user-assigned managed iden
 
     You see a list of roles assigned to the selected user-assigned managed identity at various scopes such as management group, subscription, resource group, or resource. This list includes all role assignments you have permission to read.
 
-    ![Screenshot that shows role assignments for a user-assigned managed identity.](./media/shared/role-assignments-user-assigned.png)
+    ![Screenshot of role assignments for a user-assigned managed identity.](./media/shared/role-assignments-user-assigned.png)
 
 1. To change the subscription, click the **Subscription** list.
 
@@ -134,11 +134,11 @@ You can have up to **2000** role assignments in each subscription. This limit in
 
 The role assignments limit for a subscription is currently being increased. For more information, see [Troubleshoot Azure RBAC](troubleshooting.md#limits).
 
-![Access control - Number of role assignments chart](./media/role-assignments-list-portal/access-control-role-assignments-chart.png)
+![Screenshot of Access control and number of role assignments chart.](./media/role-assignments-list-portal/access-control-role-assignments-chart.png)
 
 If you are getting close to the maximum number and you try to add more role assignments, you'll see a warning in the **Add role assignment** pane. For ways that you can reduce the number of role assignments, see [Troubleshoot Azure RBAC](troubleshooting.md#limits).
 
-![Access control - Add role assignment warning](./media/role-assignments-list-portal/add-role-assignment-warning.png)
+![Screenshot of Access control and Add role assignment warning.](./media/role-assignments-list-portal/add-role-assignment-warning.png)
 
 ## Download role assignments
 
@@ -160,7 +160,7 @@ Follow these steps to download role assignments at a scope.
 
 1. Click **Download role assignments** to open the Download role assignments pane.
 
-    ![Access control - Download role assignments](./media/role-assignments-list-portal/download-role-assignments.png)
+    ![Screenshot of Access control and Download role assignments.](./media/role-assignments-list-portal/download-role-assignments.png)
 
 1. Use the check boxes to select the role assignments you want to include in the downloaded file.
 
@@ -176,7 +176,7 @@ Follow these steps to download role assignments at a scope.
 
     The following show examples of the output for each file format.
 
-    ![Download role assignments as CSV](./media/role-assignments-list-portal/download-role-assignments-csv.png)
+    ![Screenshot of download role assignments as CSV.](./media/role-assignments-list-portal/download-role-assignments-csv.png)
 
     ![Screenshot of the downloaded role assignments as in JSON format.](./media/role-assignments-list-portal/download-role-assignments-json.png)
 

articles/role-based-access-control/media/shared/rg-check-access-select.png

@@ -7,7 +7,7 @@ manager: amycolannino
 ms.service: role-based-access-control
 ms.topic: how-to
 ms.workload: identity
-ms.date: 10/15/2021
+ms.date: 08/26/2022
 ms.author: rolyon
 ms.custom: contperf-fy21q3-portal,subject-rbac-steps
 ---
@@ -28,7 +28,7 @@ If you need to assign administrator roles in Azure Active Directory, see [Assign
 
 [!INCLUDE [Scope for Azure RBAC introduction](../../includes/role-based-access-control/scope-intro.md)] For more information, see [Understand scope](scope-overview.md).
 
-![Diagram showing the scope levels for Azure RBAC.](../../includes/role-based-access-control/media/scope-levels.png)
+![Diagram that shows the scope levels for Azure RBAC.](../../includes/role-based-access-control/media/scope-levels.png)
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
@@ -147,7 +147,7 @@ Currently, conditions can be added to built-in or custom role assignments that h
 
 [!INCLUDE [Scope for Azure RBAC introduction](../../includes/role-based-access-control/scope-intro.md)] For more information, see [Understand scope](scope-overview.md).
 
-![Diagram showing the scope levels for Azure RBAC for classic experience.](../../includes/role-based-access-control/media/scope-levels.png)
+![Diagram that shows the scope levels for Azure RBAC for classic experience.](../../includes/role-based-access-control/media/scope-levels.png)
 
 1. Sign in to the [Azure portal](https://portal.azure.com).