How to export role assignments in Azure

Before you start

Use an account that can read role assignments at the scopes you want to export: the Microsoft.Authorization/roleAssignments/read permission, which the built-in Reader role has. Microsoft lists no separate licence for it. An account that can read assignments only at a resource group gets nothing from the subscription above it. To show names, the account also needs to read the directory; without that, PowerShell reports the principal type as Unknown and the portal's download leaves the name, sign-in name and type blank.

Know what the list leaves out. Assignments that a service provider made through Azure Lighthouse aren't shown in the customer's tenant, and Microsoft Entra roles such as Global Administrator are a separate system. The examples read and export, and change nothing. The script's finally block disconnects the account and clears its saved Azure contexts, so you sign in again next time.

Option 1

Export role assignments with PowerShell

Install the modules once. The script signs in, reads the assignments of each enabled subscription, including those inherited from management groups and the root, and saves 1 row for each assignment.

Install-Module -Name Az.Accounts, Az.Resources -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptions = @(Get-AzSubscription | Where-Object State -eq 'Enabled')
    if ($subscriptions.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $found = @{}
    foreach ($sub in $subscriptions) {
        Set-AzContext -Subscription $sub.Id -Tenant $sub.TenantId -Scope Process | Out-Null
        Get-AzRoleAssignment | ForEach-Object { $found[$_.RoleAssignmentId] = $_ }
    }
    $rows = @($found.Values | Sort-Object Scope, RoleDefinitionName, DisplayName)
    if ($rows.Count -eq 0) {
        Write-Output 'No role assignments were found.'
    } else {
        $rows | Select-Object DisplayName, SignInName, ObjectType, RoleDefinitionName,
            Scope, ObjectId, RoleAssignmentId |
            Export-Csv -Path './role-assignments.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) assignments saved to role-assignments.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The CSV holds the name, sign-in name, principal type, role, scope, object ID and assignment ID. The scope says where each assignment sits: / is the root, a path that starts /providers/Microsoft.Management/managementGroups/ is a management group, and the rest are subscriptions, resource groups and resources. To narrow the export, filter $subscriptions, or add -RoleDefinitionName 'Owner' to keep 1 role. A row whose type is Group means every member of that group holds the role.

List 1 person's roles

Reconnect with Connect-AzAccount, then read 1 user's assignments in the current subscription, including the roles their groups hold.

# Run while connected to Azure. Replace the example account.
Get-AzRoleAssignment -SignInName 'person@example.com' -ExpandPrincipalGroups |
    Select-Object DisplayName, RoleDefinitionName, Scope

Option 2

Download role assignments in the Azure portal

1. Sign in to the Azure portal with an account that can read the scope's role assignments.
2. Choose All services > Subscriptions, or Management groups or Resource groups, then select the scope.
3. Choose Access control (IAM) > Role assignments. Assignments marked (Inherited) come from a scope above this one.
4. Choose Download role assignments and tick Inherited, At current scope and Children as needed. Children can't be ticked at a management group.
5. Choose CSV or JSON, enter a file name and choose Start.

The download leaves out assignments whose user, group or app has been deleted. This method suits 1 scope at a time; for every subscription in 1 file, use PowerShell or Altivane.

Common questions

Why does the same assignment show in every subscription?

It was made at a management group or the root, so it applies to every subscription below it. Microsoft's cmdlet returns it for each subscription it reaches, and the script keeps each assignment ID once.

Why is a name blank or the type Unknown?

Either the account can't read the directory, or the user, group or app was deleted and the assignment was left behind. Check with an account that can read the directory, then see how to find role assignments of deleted identities.

Why are some assignments missing?

The cmdlet returns only what the account can read, so an account limited to 1 resource group misses the subscription's assignments. Assignments a service provider made through Azure Lighthouse are also left out of the customer's list.

How do I list only the privileged roles?

Keep Owner, Contributor, User Access Administrator and Role Based Access Control Administrator. See how to list privileged role assignments in Azure.