Skip to content

Commit 4e5cd4f

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #277316 from davidsmatlak/ds-rbac-arg-samples-20240605
Add ARG samples to RBAC content set
2 parents e408873 + fa2737e commit 4e5cd4f

8 files changed

+195
-7
lines changed

‎articles/role-based-access-control/includes/query/authorization-same-principal-scope-condition.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 01/12/2024
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
AuthorizationResources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend PrincipalId = tostring(properties.principalId)
14+
| extend Scope = tolower(properties.scope)
15+
| extend RoleDefinitionId = tolower(tostring(properties.roleDefinitionId))
16+
| extend condition = tostring(properties.condition)
17+
| join kind = leftouter (
18+
AuthorizationResources
19+
| where type =~ "microsoft.authorization/roledefinitions"
20+
| extend RoleName = tostring(properties.roleName)
21+
| extend RoleId = tolower(id)
22+
| extend RoleType = tostring(properties.type)
23+
| where RoleType == "BuiltInRole"
24+
| extend RoleId_RoleName = pack(RoleId, RoleName)
25+
) on $left.RoleDefinitionId == $right.RoleId
26+
| summarize count_ = count(), AllRD = make_set(RoleId_RoleName) by PrincipalId, Scope, condition
27+
| where count_ > 1
28+
| order by count_ desc
29+
```

‎articles/role-based-access-control/includes/query/authorization-same-principal-scope.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 05/30/2023
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
AuthorizationResources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend PrincipalId = tostring(properties.principalId)
14+
| extend Scope = tolower(properties.scope)
15+
| extend RoleDefinitionId = tolower(tostring(properties.roleDefinitionId))
16+
| join kind = leftouter (
17+
AuthorizationResources
18+
| where type =~ "microsoft.authorization/roledefinitions"
19+
| extend RoleName = tostring(properties.roleName)
20+
| extend RoleId = tolower(id)
21+
| extend RoleType = tostring(properties.type)
22+
| where RoleType == "BuiltInRole"
23+
| extend RoleId_RoleName = pack(RoleId, RoleName)
24+
) on $left.RoleDefinitionId == $right.RoleId
25+
| summarize count_ = count(), AllRD = make_set(RoleId_RoleName) by PrincipalId, Scope
26+
| where count_ > 1
27+
| order by count_ desc
28+
```

‎articles/role-based-access-control/includes/query/authorization-same-role-principal-condition.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 01/12/2024
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
authorizationresources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend RoleDefinitionId = tolower(tostring(properties.roleDefinitionId))
14+
| extend PrincipalId = tolower(properties.principalId)
15+
| extend RoleDefinitionId_PrincipalId = strcat(RoleDefinitionId, "_", PrincipalId)
16+
| extend condition = tostring(properties.condition)
17+
| join kind = leftouter (
18+
authorizationresources
19+
| where type =~ "microsoft.authorization/roledefinitions"
20+
| extend RoleDefinitionName = tostring(properties.roleName)
21+
| extend rdId = tolower(id)
22+
| project RoleDefinitionName, rdId
23+
) on $left.RoleDefinitionId == $right.rdId
24+
| summarize count_ = count(), Scopes = make_set(tolower(properties.scope)) by RoleDefinitionId_PrincipalId,RoleDefinitionName
25+
| project RoleDefinitionId = split(RoleDefinitionId_PrincipalId, "_", 0)[0], RoleDefinitionName, PrincipalId = split(RoleDefinitionId_PrincipalId, "_", 1)[0], count_, Scopes, condition
26+
| where count_ > 1
27+
| order by count_ desc
28+
```

‎articles/role-based-access-control/includes/query/authorization-same-role-principal.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 05/30/2023
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
authorizationresources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend RoleDefinitionId = tolower(tostring(properties.roleDefinitionId))
14+
| extend PrincipalId = tolower(properties.principalId)
15+
| extend RoleDefinitionId_PrincipalId = strcat(RoleDefinitionId, "_", PrincipalId)
16+
| join kind = leftouter (
17+
authorizationresources
18+
| where type =~ "microsoft.authorization/roledefinitions"
19+
| extend RoleDefinitionName = tostring(properties.roleName)
20+
| extend rdId = tolower(id)
21+
| project RoleDefinitionName, rdId
22+
) on $left.RoleDefinitionId == $right.rdId
23+
| summarize count_ = count(), Scopes = make_set(tolower(properties.scope)) by RoleDefinitionId_PrincipalId,RoleDefinitionName
24+
| project RoleDefinitionId = split(RoleDefinitionId_PrincipalId, "_", 0)[0], RoleDefinitionName, PrincipalId = split(RoleDefinitionId_PrincipalId, "_", 1)[0], count_, Scopes
25+
| where count_ > 1
26+
| order by count_ desc
27+
```

‎articles/role-based-access-control/includes/query/authorization-same-role-scope-condition.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 01/12/2024
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
authorizationresources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend RoleId = tolower(tostring(properties.roleDefinitionId))
14+
| extend condition = tostring(properties.condition)
15+
| join kind = leftouter (
16+
authorizationresources
17+
| where type =~ "microsoft.authorization/roledefinitions"
18+
| extend RoleDefinitionName = tostring(properties.roleName)
19+
| extend RoleId = tolower(id)
20+
| project RoleDefinitionName, RoleId
21+
) on $left.RoleId == $right.RoleId
22+
| extend principalId = tostring(properties.principalId)
23+
| extend principal_to_ra = pack(principalId, id)
24+
| summarize count_ = count(), AllPrincipals = make_set(principal_to_ra) by RoleDefinitionId = RoleId, Scope = tolower(properties.scope), RoleDefinitionName, condition
25+
| where count_ > 1
26+
| order by count_ desc
27+
```

‎articles/role-based-access-control/includes/query/authorization-same-role-scope.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 05/30/2023
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
authorizationresources
11+
| where type =~ "microsoft.authorization/roleassignments"
12+
| where id startswith "/subscriptions"
13+
| extend RoleId = tolower(tostring(properties.roleDefinitionId))
14+
| join kind = leftouter (
15+
authorizationresources
16+
| where type =~ "microsoft.authorization/roledefinitions"
17+
| extend RoleDefinitionName = tostring(properties.roleName)
18+
| extend RoleId = tolower(id)
19+
| project RoleDefinitionName, RoleId
20+
) on $left.RoleId == $right.RoleId
21+
| extend principalId = tostring(properties.principalId)
22+
| extend principal_to_ra = pack(principalId, id)
23+
| summarize count_ = count(), AllPrincipals = make_set(principal_to_ra) by RoleDefinitionId = RoleId, Scope = tolower(properties.scope), RoleDefinitionName
24+
| where count_ > 1
25+
| order by count_ desc
26+
```

‎articles/role-based-access-control/includes/query/authorization-unused-custom-roles.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
author: rolyon
3+
ms.service: resource-graph
4+
ms.topic: include
5+
ms.date: 05/30/2023
6+
ms.author: rolyon
7+
---
8+
9+
```kusto
10+
AuthorizationResources
11+
| where type =~ "microsoft.authorization/roledefinitions"
12+
| where tolower(properties.type) == "customrole"
13+
| extend rdId = tolower(id)
14+
| extend Scope = tolower(properties.assignableScopes)
15+
| join kind = leftouter (
16+
AuthorizationResources
17+
| where type =~ "microsoft.authorization/roleassignments"
18+
| extend RoleId = tolower(tostring(properties.roleDefinitionId))
19+
| summarize RoleAssignmentCount = count() by RoleId
20+
) on $left.rdId == $right.RoleId
21+
| where isempty(RoleAssignmentCount)
22+
| project RoleDefinitionId = rdId, RoleDefinitionName = tostring(properties.roleName), Scope
23+
```

‎articles/role-based-access-control/troubleshoot-limits.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,11 @@ To reduce the number of role assignments in the subscription, add principals (us
6868

6969
# [Default](#tab/default)
7070

71-
[!INCLUDE [resource-graph-query-authorization-same-role-scope](../governance/includes/resource-graph/query/authorization-same-role-scope.md)]
71+
[!INCLUDE [resource-graph-query-authorization-same-role-scope](./includes/query/authorization-same-role-scope.md)]
7272

7373
# [Conditions](#tab/conditions)
7474

75-
[!INCLUDE [resource-graph-query-authorization-same-role-scope-condition](../governance/includes/resource-graph/query/authorization-same-role-scope-condition.md)]
75+
[!INCLUDE [resource-graph-query-authorization-same-role-scope-condition](./includes/query/authorization-same-role-scope-condition.md)]
7676

7777
---
7878

@@ -152,11 +152,11 @@ To reduce the number of role assignments in the subscription, remove redundant r
152152

153153
# [Default](#tab/default)
154154

155-
[!INCLUDE [resource-graph-query-authorization-same-role-principal](../governance/includes/resource-graph/query/authorization-same-role-principal.md)]
155+
[!INCLUDE [resource-graph-query-authorization-same-role-principal](./includes/query/authorization-same-role-principal.md)]
156156

157157
# [Conditions](#tab/conditions)
158158

159-
[!INCLUDE [resource-graph-query-authorization-same-role-principal-condition](../governance/includes/resource-graph/query/authorization-same-role-principal-condition.md)]
159+
[!INCLUDE [resource-graph-query-authorization-same-role-principal-condition](./includes/query/authorization-same-role-principal-condition.md)]
160160

161161
---
162162

@@ -222,11 +222,11 @@ To reduce the number of role assignments in the subscription, replace multiple b
222222

223223
# [Default](#tab/default)
224224

225-
[!INCLUDE [resource-graph-query-authorization-same-principal-scope](../governance/includes/resource-graph/query/authorization-same-principal-scope.md)]
225+
[!INCLUDE [resource-graph-query-authorization-same-principal-scope](./includes/query/authorization-same-principal-scope.md)]
226226

227227
# [Condition](#tab/conditions)
228228

229-
[!INCLUDE [resource-graph-query-authorization-same-principal-scope-condition](../governance/includes/resource-graph/query/authorization-same-principal-scope-condition.md)]
229+
[!INCLUDE [resource-graph-query-authorization-same-principal-scope-condition](./includes/query/authorization-same-principal-scope-condition.md)]
230230

231231
---
232232

@@ -324,7 +324,7 @@ Follow these steps to find and delete unused Azure custom roles.
324324

325325
This query checks active role assignments and doesn't consider eligible custom role assignments in [Microsoft Entra Privileged Identity Management](/entra/id-governance/privileged-identity-management/pim-resource-roles-assign-roles). To list eligible custom role assignments, you can use the Microsoft Entra admin center, PowerShell, or REST API. For more information, see [Get-AzRoleEligibilityScheduleInstance](/powershell/module/az.resources/get-azroleeligibilityscheduleinstance) or [Role Eligibility Schedule Instances - List For Scope](/rest/api/authorization/role-eligibility-schedule-instances/list-for-scope).
326326

327-
[!INCLUDE [resource-graph-query-authorization-unused-custom-roles](../governance/includes/resource-graph/query/authorization-unused-custom-roles.md)]
327+
[!INCLUDE [resource-graph-query-authorization-unused-custom-roles](./includes/query/authorization-unused-custom-roles.md)]
328328

329329
The following shows an example of the results:
330330

0 commit comments

Comments
 (0)