Skip to content

Commit 48bec0c

Browse files
v-shilsv-shils
authored
Merge pull request #106496 from rolyon/rolyon-rbac-rest-filters
[Azure RBAC] REST API filters update
2 parents d5d82da + 1b51a43 commit 48bec0c

File tree

6 files changed

+203
-116
lines changed

6 files changed

+203
-116
lines changed

‎articles/role-based-access-control/custom-roles-rest.md

Lines changed: 49 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.workload: multiple
1313
ms.tgt_pltfrm: rest-api
1414
ms.devlang: na
1515
ms.topic: conceptual
16-
ms.date: 04/18/2019
16+
ms.date: 03/19/2020
1717
ms.author: rolyon
1818
ms.reviewer: bagovind
1919

@@ -34,9 +34,10 @@ To list all custom roles in a directory, use the [Role Definitions - List](/rest
3434
3535
1. Replace *{filter}* with the role type.
3636
37-
| Filter | Description |
38-
| --- | --- |
39-
| `$filter=type%20eq%20'CustomRole'` | Filter based on the CustomRole type |
37+
> [!div class="mx-tableFixed"]
38+
> | Filter | Description |
39+
> | --- | --- |
40+
> | `$filter=type+eq+'CustomRole'` | Filter based on the CustomRole type |
4041
4142
## List custom roles at a scope
4243
@@ -50,17 +51,19 @@ To list custom roles at a scope, use the [Role Definitions - List](/rest/api/aut
5051
5152
1. Within the URI, replace *{scope}* with the scope for which you want to list the roles.
5253
53-
| Scope | Type |
54-
| --- | --- |
55-
| `subscriptions/{subscriptionId}` | Subscription |
56-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
57-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
54+
> [!div class="mx-tableFixed"]
55+
> | Scope | Type |
56+
> | --- | --- |
57+
> | `subscriptions/{subscriptionId}` | Subscription |
58+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
59+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
5860
5961
1. Replace *{filter}* with the role type.
6062
61-
| Filter | Description |
62-
| --- | --- |
63-
| `$filter=type%20eq%20'CustomRole'` | Filter based on the CustomRole type |
63+
> [!div class="mx-tableFixed"]
64+
> | Filter | Description |
65+
> | --- | --- |
66+
> | `$filter=type+eq+'CustomRole'` | Filter based on the CustomRole type |
6467
6568
## List a custom role definition by name
6669
@@ -74,17 +77,19 @@ To get information about a custom role by its display name, use the [Role Defini
7477
7578
1. Within the URI, replace *{scope}* with the scope for which you want to list the roles.
7679
77-
| Scope | Type |
78-
| --- | --- |
79-
| `subscriptions/{subscriptionId}` | Subscription |
80-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
81-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
80+
> [!div class="mx-tableFixed"]
81+
> | Scope | Type |
82+
> | --- | --- |
83+
> | `subscriptions/{subscriptionId}` | Subscription |
84+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
85+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
8286
8387
1. Replace *{filter}* with the display name for the role.
8488
85-
| Filter | Description |
86-
| --- | --- |
87-
| `$filter=roleName%20eq%20'{roleDisplayName}'` | Use the URL encoded form of the exact display name of the role. For instance, `$filter=roleName%20eq%20'Virtual%20Machine%20Contributor'` |
89+
> [!div class="mx-tableFixed"]
90+
> | Filter | Description |
91+
> | --- | --- |
92+
> | `$filter=roleName+eq+'{roleDisplayName}'` | Use the URL encoded form of the exact display name of the role. For instance, `$filter=roleName+eq+'Virtual%20Machine%20Contributor'` |
8893
8994
## List a custom role definition by ID
9095
@@ -100,11 +105,12 @@ To get information about a custom role by its unique identifier, use the [Role D
100105
101106
1. Within the URI, replace *{scope}* with the scope for which you want to list the roles.
102107
103-
| Scope | Type |
104-
| --- | --- |
105-
| `subscriptions/{subscriptionId}` | Subscription |
106-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
107-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
108+
> [!div class="mx-tableFixed"]
109+
> | Scope | Type |
110+
> | --- | --- |
111+
> | `subscriptions/{subscriptionId}` | Subscription |
112+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
113+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
108114
109115
1. Replace *{roleDefinitionId}* with the GUID identifier of the role definition.
110116
@@ -148,11 +154,12 @@ To create a custom role, use the [Role Definitions - Create Or Update](/rest/api
148154
149155
1. Within the URI, replace *{scope}* with the first `assignableScopes` of the custom role.
150156
151-
| Scope | Type |
152-
| --- | --- |
153-
| `subscriptions/{subscriptionId}` | Subscription |
154-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
155-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
157+
> [!div class="mx-tableFixed"]
158+
> | Scope | Type |
159+
> | --- | --- |
160+
> | `subscriptions/{subscriptionId}` | Subscription |
161+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
162+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
156163
157164
1. Replace *{roleDefinitionId}* with the GUID identifier of the custom role.
158165
@@ -213,11 +220,12 @@ To update a custom role, use the [Role Definitions - Create Or Update](/rest/api
213220
214221
1. Within the URI, replace *{scope}* with the first `assignableScopes` of the custom role.
215222
216-
| Scope | Type |
217-
| --- | --- |
218-
| `subscriptions/{subscriptionId}` | Subscription |
219-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
220-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
223+
> [!div class="mx-tableFixed"]
224+
> | Scope | Type |
225+
> | --- | --- |
226+
> | `subscriptions/{subscriptionId}` | Subscription |
227+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
228+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
221229
222230
1. Replace *{roleDefinitionId}* with the GUID identifier of the custom role.
223231
@@ -297,11 +305,12 @@ To delete a custom role, use the [Role Definitions - Delete](/rest/api/authoriza
297305
298306
1. Within the URI, replace *{scope}* with the scope that you want to delete the custom role.
299307
300-
| Scope | Type |
301-
| --- | --- |
302-
| `subscriptions/{subscriptionId}` | Subscription |
303-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
304-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
308+
> [!div class="mx-tableFixed"]
309+
> | Scope | Type |
310+
> | --- | --- |
311+
> | `subscriptions/{subscriptionId}` | Subscription |
312+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
313+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
305314
306315
1. Replace *{roleDefinitionId}* with the GUID identifier of the custom role.
307316

‎articles/role-based-access-control/deny-assignments-rest.md

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.workload: multiple
1313
ms.tgt_pltfrm: rest-api
1414
ms.devlang: na
1515
ms.topic: conceptual
16-
ms.date: 06/10/2019
16+
ms.date: 03/19/2020
1717
ms.author: rolyon
1818
ms.reviewer: bagovind
1919

@@ -41,11 +41,12 @@ To get information about a deny assignment, you must have:
4141
4242
1. Within the URI, replace *{scope}* with the scope for which you want to list the deny assignments.
4343
44-
| Scope | Type |
45-
| --- | --- |
46-
| `subscriptions/{subscriptionId}` | Subscription |
47-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
48-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
44+
> [!div class="mx-tableFixed"]
45+
> | Scope | Type |
46+
> | --- | --- |
47+
> | `subscriptions/{subscriptionId}` | Subscription |
48+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
49+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
4950
5051
1. Replace *{deny-assignment-id}* with the deny assignment identifier you want to retrieve.
5152
@@ -65,19 +66,24 @@ To get information about a deny assignment, you must have:
6566
6667
1. Within the URI, replace *{scope}* with the scope for which you want to list the deny assignments.
6768
68-
| Scope | Type |
69-
| --- | --- |
70-
| `subscriptions/{subscriptionId}` | Subscription |
71-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
72-
| `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
69+
> [!div class="mx-tableFixed"]
70+
> | Scope | Type |
71+
> | --- | --- |
72+
> | `subscriptions/{subscriptionId}` | Subscription |
73+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1` | Resource group |
74+
> | `subscriptions/{subscriptionId}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
7375
7476
1. Replace *{filter}* with the condition that you want to apply to filter the deny assignment list.
7577
76-
| Filter | Description |
77-
| --- | --- |
78-
| (no filter) | List all deny assignments at, above, and below the specified scope. |
79-
| `$filter=atScope()` | List deny assignments for only the specified scope and above. Does not include the deny assignments at subscopes. |
80-
| `$filter=denyAssignmentName%20eq%20'{deny-assignment-name}'` | List deny assignments with the specified name. |
78+
> [!div class="mx-tableFixed"]
79+
> | Filter | Description |
80+
> | --- | --- |
81+
> | (no filter) | Lists all deny assignments at, above, and below the specified scope. |
82+
> | `$filter=atScope()` | Lists deny assignments for only the specified scope and above. Does not include the deny assignments at subscopes. |
83+
> | `$filter=assignedTo('{objectId}')` | Lists deny assignments for the specified user or service principal.<br/>If the user is a member of a group that has a deny assignment, that deny assignment is also listed. This filter is transitive for groups which means that if the user is a member of a group and that group is a member of another group that has a deny assignment, that deny assignment is also listed.<br/>This filter only accepts an object ID for a user or a service principal. You cannot pass an object ID for a group. |
84+
> | `$filter=atScope()+and+assignedTo('{objectId}')` | Lists deny assignments for the specified user or service principal and at the specified scope. |
85+
> | `$filter=denyAssignmentName+eq+'{deny-assignment-name}'` | Lists deny assignments with the specified name. |
86+
> | `$filter=principalId+eq+'{objectId}'` | Lists deny assignments for the specified user, group, or service principal. |
8187
8288
## List deny assignments at the root scope (/)
8389
@@ -91,10 +97,11 @@ To get information about a deny assignment, you must have:
9197
9298
1. Replace *{filter}* with the condition that you want to apply to filter the deny assignment list. A filter is required.
9399
94-
| Filter | Description |
95-
| --- | --- |
96-
| `$filter=atScope()` | List deny assignments for only the root scope. Does not include the deny assignments at subscopes. |
97-
| `$filter=denyAssignmentName%20eq%20'{deny-assignment-name}'` | List deny assignments with the specified name. |
100+
> [!div class="mx-tableFixed"]
101+
> | Filter | Description |
102+
> | --- | --- |
103+
> | `$filter=atScope()` | List deny assignments for only the root scope. Does not include the deny assignments at subscopes. |
104+
> | `$filter=denyAssignmentName+eq+'{deny-assignment-name}'` | List deny assignments with the specified name. |
98105
99106
1. Remove elevated access.
100107

‎articles/role-based-access-control/role-assignments-list-rest.md

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.workload: multiple
1313
ms.tgt_pltfrm: rest-api
1414
ms.devlang: na
1515
ms.topic: conceptual
16-
ms.date: 01/10/2020
16+
ms.date: 03/19/2020
1717
ms.author: rolyon
1818
ms.reviewer: bagovind
1919

@@ -37,22 +37,25 @@ In RBAC, to list access, you list the role assignments. To list role assignments
3737
3838
1. Within the URI, replace *{scope}* with the scope for which you want to list the role assignments.
3939
40-
| Scope | Type |
41-
| --- | --- |
42-
| `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
43-
| `subscriptions/{subscriptionId1}` | Subscription |
44-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
45-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/ providers/Microsoft.Web/sites/mysite1` | Resource |
40+
> [!div class="mx-tableFixed"]
41+
> | Scope | Type |
42+
> | --- | --- |
43+
> | `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
44+
> | `subscriptions/{subscriptionId1}` | Subscription |
45+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
46+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/providers/Microsoft.Web/sites/mysite1` | Resource |
4647
4748
In the previous example, microsoft.web is a resource provider that refers to an App Service instance. Similarly, you can use any other resource providers and specify the scope. For more information, see [Azure Resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md) and supported [Azure Resource Manager resource provider operations](resource-provider-operations.md).
4849
4950
1. Replace *{filter}* with the condition that you want to apply to filter the role assignment list.
5051
51-
| Filter | Description |
52-
| --- | --- |
53-
| `$filter=atScope()` | Lists role assignments for only the specified scope, not including the role assignments at subscopes. |
54-
| `$filter=principalId%20eq%20'{objectId}'` | Lists role assignments for a specified user, group, or service principal. |
55-
| `$filter=assignedTo('{objectId}')` | Lists role assignments for a specified user or service principal. If the user is a member of a group that has a role assignment, that role assignment is also listed. This filter is transitive for groups which means that if the user is a member of a group and that group is a member of another group that has a role assignment, that role assignment is also listed. This filter only accepts an object ID for a user or a service principal. You cannot pass an object ID for a group. |
52+
> [!div class="mx-tableFixed"]
53+
> | Filter | Description |
54+
> | --- | --- |
55+
> | `$filter=atScope()` | Lists role assignments for only the specified scope, not including the role assignments at subscopes. |
56+
> | `$filter=assignedTo('{objectId}')` | Lists role assignments for a specified user or service principal.<br/>If the user is a member of a group that has a role assignment, that role assignment is also listed. This filter is transitive for groups which means that if the user is a member of a group and that group is a member of another group that has a role assignment, that role assignment is also listed.<br/>This filter only accepts an object ID for a user or a service principal. You cannot pass an object ID for a group. |
57+
> | `$filter=atScope()+and+assignedTo('{objectId}')` | Lists role assignments for the specified user or service principal and at the specified scope. |
58+
> | `$filter=principalId+eq+'{objectId}'` | Lists role assignments for a specified user, group, or service principal. |
5659
5760
## Next steps
5861

‎articles/role-based-access-control/role-assignments-rest.md

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.workload: multiple
1313
ms.tgt_pltfrm: rest-api
1414
ms.devlang: na
1515
ms.topic: conceptual
16-
ms.date: 11/25/2019
16+
ms.date: 03/19/2020
1717
ms.author: rolyon
1818
ms.reviewer: bagovind
1919

@@ -53,23 +53,27 @@ In RBAC, to grant access, you add a role assignment. To add a role assignment, u
5353
5454
1. Within the URI, replace *{scope}* with the scope for the role assignment.
5555
56-
| Scope | Type |
57-
| --- | --- |
58-
| `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
59-
| `subscriptions/{subscriptionId1}` | Subscription |
60-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
61-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/ providers/microsoft.web/sites/mysite1` | Resource |
56+
> [!div class="mx-tableFixed"]
57+
> | Scope | Type |
58+
> | --- | --- |
59+
> | `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
60+
> | `subscriptions/{subscriptionId1}` | Subscription |
61+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
62+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/providers/microsoft.web/sites/mysite1` | Resource |
63+
64+
In the previous example, microsoft.web is a resource provider that refers to an App Service instance. Similarly, you can use any other resource providers and specify the scope. For more information, see [Azure Resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md) and supported [Azure Resource Manager resource provider operations](resource-provider-operations.md).
6265
6366
1. Replace *{roleAssignmentName}* with the GUID identifier of the role assignment.
6467
6568
1. Within the request body, replace *{scope}* with the scope for the role assignment.
6669
67-
| Scope | Type |
68-
| --- | --- |
69-
| `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
70-
| `subscriptions/{subscriptionId1}` | Subscription |
71-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
72-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/ providers/microsoft.web/sites/mysite1` | Resource |
70+
> [!div class="mx-tableFixed"]
71+
> | Scope | Type |
72+
> | --- | --- |
73+
> | `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
74+
> | `subscriptions/{subscriptionId1}` | Subscription |
75+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
76+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/providers/microsoft.web/sites/mysite1` | Resource |
7377
7478
1. Replace *{roleDefinitionId}* with the role definition identifier.
7579
@@ -89,12 +93,13 @@ In RBAC, to remove access, you remove a role assignment. To remove a role assign
8993
9094
1. Within the URI, replace *{scope}* with the scope for removing the role assignment.
9195
92-
| Scope | Type |
93-
| --- | --- |
94-
| `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
95-
| `subscriptions/{subscriptionId1}` | Subscription |
96-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
97-
| `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/ providers/microsoft.web/sites/mysite1` | Resource |
96+
> [!div class="mx-tableFixed"]
97+
> | Scope | Type |
98+
> | --- | --- |
99+
> | `providers/Microsoft.Management/managementGroups/{groupId1}` | Management group |
100+
> | `subscriptions/{subscriptionId1}` | Subscription |
101+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
102+
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/providers/microsoft.web/sites/mysite1` | Resource |
98103
99104
1. Replace *{roleAssignmentName}* with the GUID identifier of the role assignment.
100105

0 commit comments

Comments
 (0)