How to find direct user role assignments in Azure

Before you start

Use an account that can read role assignments at the scopes you want to check, such as one with the built-in Reader role, and that can read the directory. Without directory access, PowerShell marks each principal Unknown and the script finds no users. Microsoft lists no separate licence for reading assignments.

Know what counts as direct here: a role assigned to the person's own account at the root, a management group or a subscription. Roles on resource groups and resources are left out, as are roles held through groups. The examples read and export, and change nothing. The script's finally block disconnects the account and clears its saved Azure contexts.

Option 1

Find direct user role assignments with PowerShell

Install the modules once. The script reads every role assignment in each enabled subscription, keeps those made to users at a subscription or above, and saves each assignment once.

Install-Module -Name Az.Accounts, Az.Resources -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptions = @(Get-AzSubscription | Where-Object State -eq 'Enabled')
    if ($subscriptions.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $found = @{}
    foreach ($sub in $subscriptions) {
        Set-AzContext -Subscription $sub.Id -Tenant $sub.TenantId -Scope Process | Out-Null
        $wide = @('/', "/subscriptions/$($sub.Id)")
        Get-AzRoleAssignment | Where-Object ObjectType -eq 'User' |
            Where-Object {
                $wide -contains $_.Scope -or
                $_.Scope -like '/providers/Microsoft.Management/managementGroups/*'
            } |
            ForEach-Object { $found[$_.RoleAssignmentId] = $_ }
    }
    $rows = @($found.Values | Sort-Object SignInName, Scope)
    if ($rows.Count -eq 0) {
        Write-Output 'No user holds a role directly at a subscription or above.'
    } else {
        $rows | Select-Object DisplayName, SignInName, RoleDefinitionName, Scope,
            ObjectId, RoleAssignmentId |
            Export-Csv -Path './direct-user-roles.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) direct assignments saved to direct-user-roles.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The CSV holds the person's name and sign-in name, the role, the scope, the object ID and the assignment ID. A scope of / is the root, and one starting /providers/Microsoft.Management is a management group: an assignment there is read from every subscription it reaches, so the script keeps each assignment ID once. To include resource groups and resources as well, remove the second Where-Object.

See the roles 1 person holds through groups

Reconnect, then list 1 person's roles in the current subscription, including those of the groups they belong to.

# Run while connected to Azure. Replace the example account.
Get-AzRoleAssignment -SignInName 'person@example.com' -ExpandPrincipalGroups |
    Select-Object DisplayName, ObjectType, RoleDefinitionName, Scope

Rows whose ObjectType is Group are roles the person holds through a group. Microsoft supports -ExpandPrincipalGroups for a user only.

Option 2

Review direct assignments in the Azure portal

1. Sign in to the Azure portal with an account that can read the subscription's role assignments and the directory.
2. Choose All services > Subscriptions, then select the subscription.
3. Choose Access control (IAM) > Role assignments. A role given at the subscription shows This resource; one given above it shows (Inherited).
4. To keep a list, choose Download role assignments, tick Inherited and At current scope, leave Children clear, choose CSV and choose Start.
5. In the file, filter the ObjectType column to users.

Without permission to read the directory, the download leaves DisplayName, SignInName and ObjectType blank, and it leaves out assignments whose principal was deleted. This method suits 1 subscription at a time; for many, use PowerShell or Altivane.

Common questions

Why is there a direct Owner nobody remembers giving?

The classic Service Administrator and Co-Administrator roles are retired. From December 2025, Azure gave the Owner role at subscription scope to users who still held them, and those show as direct user assignments. Check whether each person still needs Owner.

Should every direct assignment move to a group?

Microsoft recommends it: roles on groups are easier to manage, and they use fewer of the 5,000 role assignments each subscription allows. A role the person needs can then come from a group they belong to.

How do I see every assignment, resource groups included?

Export them all, then filter the scope you want. See how to export role assignments in Azure.