Skip to content

Commit df1736d

Browse files
jasongrocejasongroce
committed
Adding additional query includes
1 parent fb3762e commit df1736d

23 files changed

+1155
-0
lines changed

‎articles/governance/resource-graph/includes/query/app-service-resources-tls-version.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 12/13/2023
5+
author: davidsmatlak
6+
ms.author: davidsmatlak
7+
---
8+
9+
### List Azure App Service TLS version
10+
11+
List an Azure App Service's minimum Transport Layer Security (TLS) version for incoming requests to a web app.
12+
13+
```kusto
14+
AppServiceResources
15+
| where type =~ 'microsoft.web/sites/config'
16+
| project id, name, properties.MinTlsVersion
17+
```
18+
19+
# [Azure CLI](#tab/azure-cli)
20+
21+
```azurecli-interactive
22+
az graph query -q "AppServiceResources | where type =~ 'microsoft.web/sites/config' | project id, name, properties.MinTlsVersion"
23+
```
24+
25+
# [Azure PowerShell](#tab/azure-powershell)
26+
27+
```azurepowershell-interactive
28+
Search-AzGraph -Query "AppServiceResources | where type =~ 'microsoft.web/sites/config' | project id, name, properties.MinTlsVersion"
29+
```
30+
31+
# [Portal](#tab/azure-portal)
32+
33+
34+
35+
- Azure portal: <a href="https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade/query/AppServiceResources%0D%0A%7C%20where%20type%20%3D~%20%27microsoft.web%2Fsites%2Fconfig%27%0D%0A%7C%20project%20id%2C%20name%2C%20properties.MinTlsVersion" target="_blank">portal.azure.com</a>
36+
- Azure Government portal: <a href="https://portal.azure.us/#blade/HubsExtension/ArgQueryBlade/query/AppServiceResources%0D%0A%7C%20where%20type%20%3D~%20%27microsoft.web%2Fsites%2Fconfig%27%0D%0A%7C%20project%20id%2C%20name%2C%20properties.MinTlsVersion" target="_blank">portal.azure.us</a>
37+
- Microsoft Azure operated by 21Vianet portal: <a href="https://portal.azure.cn/#blade/HubsExtension/ArgQueryBlade/query/AppServiceResources%0D%0A%7C%20where%20type%20%3D~%20%27microsoft.web%2Fsites%2Fconfig%27%0D%0A%7C%20project%20id%2C%20name%2C%20properties.MinTlsVersion" target="_blank">portal.azure.cn</a>
38+
39+
---

‎articles/governance/resource-graph/includes/query/authorization-resources-classic-administrators-key-properties.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 08/24/2023
5+
author: danielkim916
6+
ms.author: danielkim
7+
---
8+
9+
### Get classic administrators with key properties
10+
11+
Provides a sample of [classic administrators](../../../../../role-based-access-control/classic-administrators.md) and some of the resources relevant properties.
12+
13+
```kusto
14+
authorizationresources
15+
| where type =~ 'microsoft.authorization/classicadministrators'
16+
| extend state = properties.adminState
17+
| extend roles = split(properties.role, ';')
18+
| take 5
19+
```
20+
21+
# [Azure CLI](#tab/azure-cli)
22+
23+
```azurecli-interactive
24+
az graph query -q "authorizationresources | where type =~ 'microsoft.authorization/classicadministrators' | extend state = properties.adminState | extend roles = split(properties.role, ';') | take 5"
25+
```
26+
27+
# [Azure PowerShell](#tab/azure-powershell)
28+
29+
```azurepowershell-interactive
30+
Search-AzGraph -Query "authorizationresources | where type =~ 'microsoft.authorization/classicadministrators' | extend state = properties.adminState | extend roles = split(properties.role, ';') | take 5"
31+
```
32+
33+
# [Portal](#tab/azure-portal)
34+
35+
36+
37+
- Azure portal: <a href="https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Fclassicadministrators%27%0A%7C%20extend%20state%20%3D%20properties.adminState%0A%7C%20extend%20roles%20%3D%20split%28properties.role%2C%20%27%3B%27%29%0A%7C%20take%205" target="_blank">portal.azure.com</a>
38+
- Azure Government portal: <a href="https://portal.azure.us/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Fclassicadministrators%27%0A%7C%20extend%20state%20%3D%20properties.adminState%0A%7C%20extend%20roles%20%3D%20split%28properties.role%2C%20%27%3B%27%29%0A%7C%20take%205" target="_blank">portal.azure.us</a>
39+
- Microsoft Azure operated by 21Vianet portal: <a href="https://portal.azure.cn/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Fclassicadministrators%27%0A%7C%20extend%20state%20%3D%20properties.adminState%0A%7C%20extend%20roles%20%3D%20split%28properties.role%2C%20%27%3B%27%29%0A%7C%20take%205" target="_blank">portal.azure.cn</a>
40+
41+
---

‎articles/governance/resource-graph/includes/query/authorization-resources-role-assignments-key-properties.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 07/10/2023
5+
author: davidsmatlak
6+
ms.author: davidsmatlak
7+
---
8+
9+
### Get role assignments with key properties
10+
11+
Provides a sample of [role assignments](../../../../../role-based-access-control/role-assignments.md) and some of the resources relevant properties.
12+
13+
```kusto
14+
authorizationresources
15+
| where type =~ 'microsoft.authorization/roleassignments'
16+
| extend roleDefinitionId = properties.roleDefinitionId
17+
| extend principalType = properties.principalType
18+
| extend principalId = properties.principalId
19+
| extend scope = properties.scope
20+
| take 5
21+
```
22+
23+
# [Azure CLI](#tab/azure-cli)
24+
25+
```azurecli-interactive
26+
az graph query -q "authorizationresources | where type =~ 'microsoft.authorization/roleassignments' | extend roleDefinitionId = properties.roleDefinitionId | extend principalType = properties.principalType | extend principalId = properties.principalId | extend scope = properties.scope | take 5"
27+
```
28+
29+
# [Azure PowerShell](#tab/azure-powershell)
30+
31+
```azurepowershell-interactive
32+
Search-AzGraph -Query "authorizationresources | where type =~ 'microsoft.authorization/roleassignments' | extend roleDefinitionId = properties.roleDefinitionId | extend principalType = properties.principalType | extend principalId = properties.principalId | extend scope = properties.scope | take 5"
33+
```
34+
35+
# [Portal](#tab/azure-portal)
36+
37+
38+
39+
- Azure portal: <a href="https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froleassignments%27%0A%7C%20extend%20roleDefinitionId%20%3D%20properties.roleDefinitionId%0A%7C%20extend%20principalType%20%3D%20properties.principalType%0A%7C%20extend%20principalId%20%3D%20properties.principalId%0A%7C%20extend%20scope%20%3D%20properties.scope%0A%7C%20take%205" target="_blank">portal.azure.com</a>
40+
- Azure Government portal: <a href="https://portal.azure.us/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froleassignments%27%0A%7C%20extend%20roleDefinitionId%20%3D%20properties.roleDefinitionId%0A%7C%20extend%20principalType%20%3D%20properties.principalType%0A%7C%20extend%20principalId%20%3D%20properties.principalId%0A%7C%20extend%20scope%20%3D%20properties.scope%0A%7C%20take%205" target="_blank">portal.azure.us</a>
41+
- Microsoft Azure operated by 21Vianet portal: <a href="https://portal.azure.cn/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froleassignments%27%0A%7C%20extend%20roleDefinitionId%20%3D%20properties.roleDefinitionId%0A%7C%20extend%20principalType%20%3D%20properties.principalType%0A%7C%20extend%20principalId%20%3D%20properties.principalId%0A%7C%20extend%20scope%20%3D%20properties.scope%0A%7C%20take%205" target="_blank">portal.azure.cn</a>
42+
43+
---

‎articles/governance/resource-graph/includes/query/authorization-resources-role-definitions-actions-list.md

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 07/10/2023
5+
author: davidsmatlak
6+
ms.author: davidsmatlak
7+
---
8+
9+
### Get role definitions with actions
10+
11+
Displays a sample of [role definitions](../../../../../role-based-access-control/role-definitions.md) with an expanded list of actions and not actions for each role definition's permissions list.
12+
13+
```kusto
14+
authorizationresources
15+
| where type =~ 'microsoft.authorization/roledefinitions'
16+
| extend assignableScopes = properties.assignableScopes
17+
| extend permissionsList = properties.permissions
18+
| extend isServiceRole = properties.isServiceRole
19+
| mv-expand permissionsList
20+
| extend Actions = permissionsList.Actions
21+
| extend notActions = permissionsList.notActions
22+
| extend DataActions = permissionsList.DataActions
23+
| extend notDataActions = permissionsList.notDataActions
24+
| take 5
25+
```
26+
27+
# [Azure CLI](#tab/azure-cli)
28+
29+
```azurecli-interactive
30+
az graph query -q "authorizationresources | where type =~ 'microsoft.authorization/roledefinitions' | extend assignableScopes = properties.assignableScopes | extend permissionsList = properties.permissions | extend isServiceRole = properties.isServiceRole | mv-expand permissionsList | extend Actions = permissionsList.Actions | extend notActions = permissionsList.notActions | extend DataActions = permissionsList.DataActions | extend notDataActions = permissionsList.notDataActions | take 5"
31+
```
32+
33+
# [Azure PowerShell](#tab/azure-powershell)
34+
35+
```azurepowershell-interactive
36+
Search-AzGraph -Query "authorizationresources | where type =~ 'microsoft.authorization/roledefinitions' | extend assignableScopes = properties.assignableScopes | extend permissionsList = properties.permissions | extend isServiceRole = properties.isServiceRole | mv-expand permissionsList | extend Actions = permissionsList.Actions | extend notActions = permissionsList.notActions | extend DataActions = permissionsList.DataActions | extend notDataActions = permissionsList.notDataActions | take 5"
37+
```
38+
39+
# [Portal](#tab/azure-portal)
40+
41+
42+
43+
- Azure portal: <a href="https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20mv-expand%20permissionsList%0A%7C%20extend%20Actions%20%3D%20permissionsList.Actions%0A%7C%20extend%20notActions%20%3D%20permissionsList.notActions%0A%7C%20extend%20DataActions%20%3D%20permissionsList.DataActions%0A%7C%20extend%20notDataActions%20%3D%20permissionsList.notDataActions%0A%7C%20take%205" target="_blank">portal.azure.com</a>
44+
- Azure Government portal: <a href="https://portal.azure.us/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20mv-expand%20permissionsList%0A%7C%20extend%20Actions%20%3D%20permissionsList.Actions%0A%7C%20extend%20notActions%20%3D%20permissionsList.notActions%0A%7C%20extend%20DataActions%20%3D%20permissionsList.DataActions%0A%7C%20extend%20notDataActions%20%3D%20permissionsList.notDataActions%0A%7C%20take%205" target="_blank">portal.azure.us</a>
45+
- Microsoft Azure operated by 21Vianet portal: <a href="https://portal.azure.cn/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20mv-expand%20permissionsList%0A%7C%20extend%20Actions%20%3D%20permissionsList.Actions%0A%7C%20extend%20notActions%20%3D%20permissionsList.notActions%0A%7C%20extend%20DataActions%20%3D%20permissionsList.DataActions%0A%7C%20extend%20notDataActions%20%3D%20permissionsList.notDataActions%0A%7C%20take%205" target="_blank">portal.azure.cn</a>
46+
47+
---

‎articles/governance/resource-graph/includes/query/authorization-resources-role-definitions-key-properties.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 07/10/2023
5+
author: davidsmatlak
6+
ms.author: davidsmatlak
7+
---
8+
9+
### Get role definitions with key properties
10+
11+
Provides a sample of [role definitions](../../../../../role-based-access-control/role-definitions.md) and some of the resources relevant properties.
12+
13+
```kusto
14+
authorizationresources
15+
| where type =~ 'microsoft.authorization/roledefinitions'
16+
| extend assignableScopes = properties.assignableScopes
17+
| extend permissionsList = properties.permissions
18+
| extend isServiceRole = properties.isServiceRole
19+
| take 5
20+
```
21+
22+
# [Azure CLI](#tab/azure-cli)
23+
24+
```azurecli-interactive
25+
az graph query -q "authorizationresources | where type =~ 'microsoft.authorization/roledefinitions' | extend assignableScopes = properties.assignableScopes | extend permissionsList = properties.permissions | extend isServiceRole = properties.isServiceRole | take 5"
26+
```
27+
28+
# [Azure PowerShell](#tab/azure-powershell)
29+
30+
```azurepowershell-interactive
31+
Search-AzGraph -Query "authorizationresources | where type =~ 'microsoft.authorization/roledefinitions' | extend assignableScopes = properties.assignableScopes | extend permissionsList = properties.permissions | extend isServiceRole = properties.isServiceRole | take 5"
32+
```
33+
34+
# [Portal](#tab/azure-portal)
35+
36+
37+
38+
- Azure portal: <a href="https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20take%205" target="_blank">portal.azure.com</a>
39+
- Azure Government portal: <a href="https://portal.azure.us/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20take%205" target="_blank">portal.azure.us</a>
40+
- Microsoft Azure operated by 21Vianet portal: <a href="https://portal.azure.cn/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20take%205" target="_blank">portal.azure.cn</a>
41+
42+
---

‎articles/governance/resource-graph/includes/query/authorization-resources-role-definitions-permissions-list.md

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 07/10/2023
5+
author: davidsmatlak
6+
ms.author: davidsmatlak
7+
---
8+
9+
### Get role definitions with permissions listed out
10+
11+
Displays a summary of the `Actions` and `notActions` for each unique role definition.
12+
13+
```kusto
14+
authorizationresources
15+
| where type =~ 'microsoft.authorization/roledefinitions'
16+
| extend assignableScopes = properties.assignableScopes
17+
| extend permissionsList = properties.permissions
18+
| extend isServiceRole = properties.isServiceRole
19+
| mv-expand permissionsList
20+
| extend Actions = permissionsList.Actions
21+
| extend notActions = permissionsList.notActions
22+
| extend DataActions = permissionsList.DataActions
23+
| extend notDataActions = permissionsList.notDataActions
24+
| summarize make_set(Actions), make_set(notActions), make_set(DataActions), make_set(notDataActions), any(assignableScopes, isServiceRole) by id
25+
```
26+
27+
# [Azure CLI](#tab/azure-cli)
28+
29+
```azurecli-interactive
30+
az graph query -q "authorizationresources | where type =~ 'microsoft.authorization/roledefinitions' | extend assignableScopes = properties.assignableScopes | extend permissionsList = properties.permissions | extend isServiceRole = properties.isServiceRole | mv-expand permissionsList | extend Actions = permissionsList.Actions | extend notActions = permissionsList.notActions | extend DataActions = permissionsList.DataActions | extend notDataActions = permissionsList.notDataActions | summarize make_set(Actions), make_set(notActions), make_set(DataActions), make_set(notDataActions), any(assignableScopes, isServiceRole) by id"
31+
```
32+
33+
# [Azure PowerShell](#tab/azure-powershell)
34+
35+
```azurepowershell-interactive
36+
Search-AzGraph -Query "authorizationresources | where type =~ 'microsoft.authorization/roledefinitions' | extend assignableScopes = properties.assignableScopes | extend permissionsList = properties.permissions | extend isServiceRole = properties.isServiceRole | mv-expand permissionsList | extend Actions = permissionsList.Actions | extend notActions = permissionsList.notActions | extend DataActions = permissionsList.DataActions | extend notDataActions = permissionsList.notDataActions | summarize make_set(Actions), make_set(notActions), make_set(DataActions), make_set(notDataActions), any(assignableScopes, isServiceRole) by id"
37+
```
38+
39+
# [Portal](#tab/azure-portal)
40+
41+
42+
43+
- Azure portal: <a href="https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20mv-expand%20permissionsList%0A%7C%20extend%20Actions%20%3D%20permissionsList.Actions%0A%7C%20extend%20notActions%20%3D%20permissionsList.notActions%0A%7C%20extend%20DataActions%20%3D%20permissionsList.DataActions%0A%7C%20extend%20notDataActions%20%3D%20permissionsList.notDataActions%0A%7C%20summarize%20make_set%28Actions%29%2C%20make_set%28notActions%29%2C%20make_set%28DataActions%29%2C%20make_set%28notDataActions%29%2C%20any%28assignableScopes%2C%20isServiceRole%29%20by%20id" target="_blank">portal.azure.com</a>
44+
- Azure Government portal: <a href="https://portal.azure.us/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20mv-expand%20permissionsList%0A%7C%20extend%20Actions%20%3D%20permissionsList.Actions%0A%7C%20extend%20notActions%20%3D%20permissionsList.notActions%0A%7C%20extend%20DataActions%20%3D%20permissionsList.DataActions%0A%7C%20extend%20notDataActions%20%3D%20permissionsList.notDataActions%0A%7C%20summarize%20make_set%28Actions%29%2C%20make_set%28notActions%29%2C%20make_set%28DataActions%29%2C%20make_set%28notDataActions%29%2C%20any%28assignableScopes%2C%20isServiceRole%29%20by%20id" target="_blank">portal.azure.us</a>
45+
- Microsoft Azure operated by 21Vianet portal: <a href="https://portal.azure.cn/#blade/HubsExtension/ArgQueryBlade/query/authorizationresources%0A%7C%20where%20type%20%3D~%20%27microsoft.authorization%2Froledefinitions%27%0A%7C%20extend%20assignableScopes%20%3D%20properties.assignableScopes%0A%7C%20extend%20permissionsList%20%3D%20properties.permissions%0A%7C%20extend%20isServiceRole%20%3D%20properties.isServiceRole%0A%7C%20mv-expand%20permissionsList%0A%7C%20extend%20Actions%20%3D%20permissionsList.Actions%0A%7C%20extend%20notActions%20%3D%20permissionsList.notActions%0A%7C%20extend%20DataActions%20%3D%20permissionsList.DataActions%0A%7C%20extend%20notDataActions%20%3D%20permissionsList.notDataActions%0A%7C%20summarize%20make_set%28Actions%29%2C%20make_set%28notActions%29%2C%20make_set%28DataActions%29%2C%20make_set%28notDataActions%29%2C%20any%28assignableScopes%2C%20isServiceRole%29%20by%20id" target="_blank">portal.azure.cn</a>
46+
47+
---

‎articles/governance/resource-graph/includes/query/authorization-resources-troubleshoot-rbac-limits.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
ms.service: resource-graph
3+
ms.topic: include
4+
ms.date: 08/31/2023
5+
author: davidsmatlak
6+
ms.author: davidsmatlak
7+
---
8+
9+
### Troubleshoot Azure RBAC limits
10+
11+
The `authorizationresources` table can be used to troubleshoot Azure role-based access control (Azure RBAC) if you exceed limits. For more information, go to [Troubleshoot Azure RBAC limits](../../../../../role-based-access-control/troubleshoot-limits.md).

0 commit comments

Comments
 (0)