Skip to content

Commit 01389a6

Browse files
rolyonrolyon
committed
Add conditions to troubleshoot limit queries as tabs
1 parent 55b32d8 commit 01389a6

File tree

4 files changed

+109
-1
lines changed

4 files changed

+109
-1
lines changed

‎articles/governance/includes/resource-graph/query/authorization-same-principal-scope-condition.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 01/12/2024
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
AuthorizationResources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend PrincipalId = tostring(properties.principalId)
14+
| extend Scope = tolower(properties.scope)
15+
| extend RoleDefinitionId = tolower(tostring(properties.roleDefinitionId))
16+
| extend condition = tostring(properties.condition)
17+
| join kind = leftouter (
18+
AuthorizationResources
19+
| where type =~ "microsoft.authorization/roledefinitions"
20+
| extend RoleName = tostring(properties.roleName)
21+
| extend RoleId = tolower(id)
22+
| extend RoleType = tostring(properties.type)
23+
| where RoleType == "BuiltInRole"
24+
| extend RoleId_RoleName = pack(RoleId, RoleName)
25+
) on $left.RoleDefinitionId == $right.RoleId
26+
| summarize count_ = count(), AllRD = make_set(RoleId_RoleName) by PrincipalId, Scope, condition
27+
| where count_ > 1
28+
| order by count_ desc
29+
```

‎articles/governance/includes/resource-graph/query/authorization-same-role-principal-condition.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 01/12/2024
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
authorizationresources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend RoleDefinitionId = tolower(tostring(properties.roleDefinitionId))
14+
| extend PrincipalId = tolower(properties.principalId)
15+
| extend RoleDefinitionId_PrincipalId = strcat(RoleDefinitionId, "_", PrincipalId)
16+
| extend condition = tostring(properties.condition)
17+
| join kind = leftouter (
18+
authorizationresources
19+
| where type =~ "microsoft.authorization/roledefinitions"
20+
| extend RoleDefinitionName = tostring(properties.roleName)
21+
| extend rdId = tolower(id)
22+
| project RoleDefinitionName, rdId
23+
) on $left.RoleDefinitionId == $right.rdId
24+
| summarize count_ = count(), Scopes = make_set(tolower(properties.scope)) by RoleDefinitionId_PrincipalId,RoleDefinitionName
25+
| project RoleDefinitionId = split(RoleDefinitionId_PrincipalId, "_", 0)[0], RoleDefinitionName, PrincipalId = split(RoleDefinitionId_PrincipalId, "_", 1)[0], count_, Scopes, condition
26+
| where count_ > 1
27+
| order by count_ desc
28+
```

‎articles/governance/includes/resource-graph/query/authorization-same-role-scope-condition.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 01/12/2024
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
authorizationresources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend RoleId = tolower(tostring(properties.roleDefinitionId))
14+
| extend condition = tostring(properties.condition)
15+
| join kind = leftouter (
16+
authorizationresources
17+
| where type =~ "microsoft.authorization/roledefinitions"
18+
| extend RoleDefinitionName = tostring(properties.roleName)
19+
| extend RoleId = tolower(id)
20+
| project RoleDefinitionName, RoleId
21+
) on $left.RoleId == $right.RoleId
22+
| extend principalId = tostring(properties.principalId)
23+
| extend principal_to_ra = pack(principalId, id)
24+
| summarize count_ = count(), AllPrincipals = make_set(principal_to_ra) by RoleDefinitionId = RoleId, Scope = tolower(properties.scope), RoleDefinitionName, condition
25+
| where count_ > 1
26+
| order by count_ desc
27+
```

‎articles/role-based-access-control/troubleshoot-limits.md

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ manager: amycolannino
77
ms.service: role-based-access-control
88
ms.topic: how-to
99
ms.workload: identity
10-
ms.date: 12/01/2023
10+
ms.date: 01/12/2024
1111
ms.author: rolyon
1212
---
1313

@@ -66,8 +66,16 @@ To reduce the number of role assignments in the subscription, add principals (us
6666

6767
This query checks active role assignments and doesn't consider eligible role assignments in [Microsoft Entra Privileged Identity Management](../active-directory/privileged-identity-management/pim-resource-roles-assign-roles.md).
6868

69+
# [Default](#tab/default)
70+
6971
[!INCLUDE [resource-graph-query-authorization-same-role-scope](../governance/includes/resource-graph/query/authorization-same-role-scope.md)]
7072

73+
# [Condition](#tab/condition)
74+
75+
[!INCLUDE [resource-graph-query-authorization-same-role-scope-condition](../governance/includes/resource-graph/query/authorization-same-role-scope-condition.md)]
76+
77+
---
78+
7179
The following shows an example of the results. The **count_** column is the number of principals assigned the same role and at the same scope. The count is sorted in descending order.
7280

7381
:::image type="content" source="media/troubleshoot-limits/authorization-same-role-scope.png" alt-text="Screenshot of Azure Resource Graph Explorer that shows role assignments with the same role and at the same scope, but for different principals." lightbox="media/troubleshoot-limits/authorization-same-role-scope.png":::
@@ -140,8 +148,16 @@ To reduce the number of role assignments in the subscription, remove redundant r
140148

141149
This query checks active role assignments and doesn't consider eligible role assignments in [Microsoft Entra Privileged Identity Management](../active-directory/privileged-identity-management/pim-resource-roles-assign-roles.md).
142150

151+
# [Default](#tab/default)
152+
143153
[!INCLUDE [resource-graph-query-authorization-same-role-principal](../governance/includes/resource-graph/query/authorization-same-role-principal.md)]
144154

155+
# [Condition](#tab/condition)
156+
157+
[!INCLUDE [resource-graph-query-authorization-same-role-principal-condition](../governance/includes/resource-graph/query/authorization-same-role-principal-condition.md)]
158+
159+
---
160+
145161
The following shows an example of the results. The **count_** column is the number of different scopes for role assignments with the same role and same principal. The count is sorted in descending order.
146162

147163
:::image type="content" source="media/troubleshoot-limits/authorization-same-role-principal.png" alt-text="Screenshot of Azure Resource Graph Explorer that shows role assignments for the same role and same principal, but at different scopes." lightbox="media/troubleshoot-limits/authorization-same-role-principal.png":::
@@ -200,8 +216,16 @@ To reduce the number of role assignments in the subscription, replace multiple b
200216

201217
This query checks active role assignments and doesn't consider eligible role assignments in [Microsoft Entra Privileged Identity Management](../active-directory/privileged-identity-management/pim-resource-roles-assign-roles.md).
202218

219+
# [Default](#tab/default)
220+
203221
[!INCLUDE [resource-graph-query-authorization-same-principal-scope](../governance/includes/resource-graph/query/authorization-same-principal-scope.md)]
204222

223+
# [Condition](#tab/condition)
224+
225+
[!INCLUDE [resource-graph-query-authorization-same-principal-scope-condition](../governance/includes/resource-graph/query/authorization-same-principal-scope-condition.md)]
226+
227+
---
228+
205229
The following shows an example of the results. The **count_** column is the number of different built-in role assignments with the same principal and same scope. The count is sorted in descending order.
206230

207231
:::image type="content" source="media/troubleshoot-limits/authorization-same-principal-scope.png" alt-text="Screenshot of Azure Resource Graph Explorer that shows role assignments for with the same principal and same scope." lightbox="media/troubleshoot-limits/authorization-same-principal-scope.png":::

0 commit comments

Comments
 (0)