Use PowerShell to Find the Right Azure Roles in Minutes 🔍

 

As an IT professional working with Azure, it’s essential to assign the right roles to manage resources efficiently while following the principle of least privilege. My new PowerShell script helps you identify the appropriate Azure roles for managing specific resources (e.g., storage, resource groups) by displaying detailed role information in an interactive window. This tool is perfect for simplifying role assignments and enhancing security. 📌 Key points to consider:

1. The script requires the Az PowerShell module to be installed.
2. You must be logged into Azure with sufficient permissions (e.g., Reader or Contributor) to retrieve role definitions.
3. The output is sorted from least privilege to most privilege, aiding zero trust implementations.

💡 Note: Ensure you’re connected to the correct Azure subscription, as role data depends on your context. Test the script in a non-production environment first! This script is a great way to streamline role management for your team and improve Azure governance. Follow for more Azure tips and scripts! 🚀

PowerShell Script

## NOTE! Some points to consider for you and the customer

## 1. The script requires the Az PowerShell module to be installed.
## 2. You must be logged into Azure with sufficient permissions (e.g., Reader or Contributor).
## 3. Ensure you’re connected to the correct Azure subscription.



## Install the Az module if not already installed
Install-Module -Name Az -Force -AllowClobber

## Connect to Azure (log in with an account that has access)
Connect-AzAccount

## The script below helps you find roles for managing Azure resources
# Function to check if an action matches a pattern
function DoesActionMatch {
    param (
        [string]$specificAction,
        [string]$pattern
    )
    $regex = $pattern -replace '\*', '.*' -replace '/', '\/'
    if ($specificAction -match "^$regex$") { return $true }
    return $false
}

# Resource map for common terms
$resourceMap = @{
    "storage" = "Microsoft.Storage/*"
    "resource group" = "Microsoft.Resources/subscriptions/resourceGroups/*"
    "virtual machine" = "Microsoft.Compute/virtualMachines/*"
    "vm" = "Microsoft.Compute/virtualMachines/*"
    "network" = "Microsoft.Network/*"
    "sql" = "Microsoft.Sql/*"
    "key vault" = "Microsoft.KeyVault/*"
}

# Ask user what to manage
$userInput = Read-Host "Enter what you want to manage (e.g., 'I want to manage storage' or 'resource group')"

# Parse input
$resourceKey = $null
foreach ($key in $resourceMap.Keys) {
    if ($userInput.ToLower() -match $key) { $resourceKey = $key; break }
}

if (-not $resourceKey) {
    Write-Host "Kunde inte identifiera resursen. Försök igen med t.ex. 'storage', 'resource group' eller 'virtual machine'."
    return
}

$pattern = $resourceMap[$resourceKey]
Write-Host "Söker roller för '$resourceKey' (pattern: $pattern)..."

# Get all built-in roles
$roles = Get-AzRoleDefinition | Where-Object { $_.IsCustom -eq $false }

# Collect matching roles
$matchingRoles = @()
foreach ($role in $roles) {
    $relevantActions = @()
    foreach ($action in $role.Actions) {
        if (DoesActionMatch $action $pattern) { $relevantActions += $action }
    }
    $denied = $false
    foreach ($notAction in $role.NotActions) {
        if (DoesActionMatch $notAction $pattern) { $denied = $true; break }
    }
    if ($relevantActions.Count -gt 0 -and -not $denied) {
        $privilegeLevel = $role.Actions.Count
        $roleName = if ($role.Name) { $role.Name.Trim() } else { if ($role.RoleName) { $role.RoleName.Trim() } else { "Okänd roll (felsök: $($role.Id))" } }
        $description = if ($role.Description) { $role.Description.Trim() } else { "Ingen beskrivning tillgänglig" }
        $matchingRoles += [pscustomobject]@{Roll=$roleName; Beskrivning=$description; PrivilegieNivå=$privilegeLevel; RelevantaActions=($relevantActions -join "; ")}
    }
}

# Show in popup window, sorted from least to most privilege
if ($matchingRoles.Count -gt 0) {
    $matchingRoles | Sort-Object PrivilegieNivå | Select-Object Roll, Beskrivning, PrivilegieNivå, RelevantaActions | Out-GridView -Title "Roller för att managera '$resourceKey' (sorterat från minst till mest privilegier)"
} else {
    [pscustomobject]@{Roll="Inga roller hittades"; Beskrivning="Ingen match för '$pattern'"; PrivilegieNivå=0; RelevantaActions=""} | Out-GridView -Title "Roller för att managera '$resourceKey' (inget resultat)"
}