đ New PowerShell Script: Reveal Explicit Azure IAM Permissions đđ
đĄ️ Azure IAM: Report Explicit Role Assignments
This PowerShell script collects all explicit role assignments across your Azure environment – including Management Groups, Subscriptions, Resource Groups, and Resources – and generates an easy-to-read HTML report.
✅ What It Does:
- Skips inherited permissions – only shows direct (explicit) role assignments
- Lists user/group/service principal roles by scope
- Exports a local HTML report you can archive or review
Explicit IAM Report – PowerShell
Connect-AzAccount
function Get-ExplicitRoleAssignments {
param ([string]$Scope)
Write-Host "Fetching role assignments for scope: $Scope"
try {
$roleAssignments = Get-AzRoleAssignment -Scope $Scope -ErrorAction Stop
$explicitAssignments = $roleAssignments | Where-Object { $_.Scope -eq $Scope }
return $explicitAssignments
} catch {
Write-Host "Error fetching assignments for $Scope : $_"
return $null
}
}
$report = @()
$managementGroups = Get-AzManagementGroup -ErrorAction SilentlyContinue
if ($managementGroups) {
foreach ($mg in $managementGroups) {
$explicitAssignments = Get-ExplicitRoleAssignments -Scope $mg.Id
foreach ($assignment in $explicitAssignments) {
$report += [PSCustomObject]@{
ScopeType = "ManagementGroup"
ScopeName = $mg.Name
RoleName = $assignment.RoleDefinitionName
PrincipalName = $assignment.DisplayName
PrincipalType = $assignment.ObjectType
AssignmentScope = $assignment.Scope
}
}
}
}
$subscriptions = Get-AzSubscription
foreach ($sub in $subscriptions) {
$explicitAssignments = Get-ExplicitRoleAssignments -Scope "/subscriptions/$($sub.Id)"
foreach ($assignment in $explicitAssignments) {
$report += [PSCustomObject]@{
ScopeType = "Subscription"
ScopeName = $sub.Name
RoleName = $assignment.RoleDefinitionName
PrincipalName = $assignment.DisplayName
PrincipalType = $assignment.ObjectType
AssignmentScope = $assignment.Scope
}
}
Select-AzSubscription -SubscriptionId $sub.Id
$resourceGroups = Get-AzResourceGroup
foreach ($rg in $resourceGroups) {
$explicitAssignments = Get-ExplicitRoleAssignments -Scope $rg.ResourceId
foreach ($assignment in $explicitAssignments) {
$report += [PSCustomObject]@{
ScopeType = "ResourceGroup"
ScopeName = $rg.ResourceGroupName
RoleName = $assignment.RoleDefinitionName
PrincipalName = $assignment.DisplayName
PrincipalType = $assignment.ObjectType
AssignmentScope = $assignment.Scope
}
}
$resources = Get-AzResource -ResourceGroupName $rg.ResourceGroupName
foreach ($res in $resources) {
$explicitAssignments = Get-ExplicitRoleAssignments -Scope $res.ResourceId
foreach ($assignment in $explicitAssignments) {
$report += [PSCustomObject]@{
ScopeType = "Resource"
ScopeName = $res.Name
RoleName = $assignment.RoleDefinitionName
PrincipalName = $assignment.DisplayName
PrincipalType = $assignment.ObjectType
AssignmentScope = $assignment.Scope
}
}
}
}
}
$htmlHeader = @"
<!DOCTYPE html>
<html><head><title>Azure IAM Explicit Permissions Report</title>
<style>
body { font-family: Arial; margin: 20px; }
table { width: 100%; border-collapse: collapse; }
th, td { border: 1px solid #ddd; padding: 8px; }
th { background: #f2f2f2; }
tr:nth-child(even) { background: #f9f9f9; }
</style></head><body>
<h1>Azure IAM Explicit Permissions Report</h1>
<p>Explicit assignments found: $($report.Count)</p>
"@
if ($report.Count -eq 0) {
$htmlBody = "<p><strong>No explicit permissions were found.</strong></p>"
} else {
$htmlBody = $report | ConvertTo-Html -Fragment -Property ScopeType, ScopeName, RoleName, PrincipalName, PrincipalType, AssignmentScope
}
$htmlFooter = "</body></html>"
$htmlContent = $htmlHeader + $htmlBody + $htmlFooter
$htmlContent | Out-File -FilePath "C:\AzureIAM_ExplicitPermissions.html" -Encoding UTF8
Write-Host "Report generated: C:\AzureIAM_ExplicitPermissions.html"
Kommentarer
Skicka en kommentar