1

I would like list roleAssignments of a group with GraphAPI. But I only see an API to list whole roleAssignments.
I tried to filter by resourceScopes/scopeMembers using $filter clause but it's not working.

Should I filter this whole list myself or is there any other way to do it?

Marc LaFleur
  • 31,987
  • 4
  • 37
  • 63
dongseok0
  • 737
  • 2
  • 7
  • 18

1 Answers1

3

It seems like you are looking for Azure RBAC role assignments.

These are different from what you've linked to, which are Intune device management role assignments (which are specific to Intune RBAC roles). They are also different from Azure AD app role assignments (which are for assigning an app or a user/group to another app's role), and Azure AD directory role membership (which is for assigning users to directory roles).

You can list all Azure RBAC role assignments using the Azure Management API. You can also filter this request by scope and/or by which user, group or app the role assignment is for.

For example, to list all the scopes a group {group-id} has been assigned to for a subscription {sub-id}:

GET https://management.azure.com/subscriptions/{sub-id}/providers/Microsoft.Authorization/roleAssignments?api-version=2015-07-01&$filter=principalId%20eq%20'{group-id}'

For more details, you can read Manage Role-Based Access Control with the REST API.

Philippe Signoret
  • 13,299
  • 1
  • 40
  • 58
  • so I guess it's not possible with GraphAPI? – dongseok0 Apr 23 '18 at 08:56
  • @dongseok0. Sorry for that. I didn't realize it's a array for resourceScopes. – Wayne Yang Apr 23 '18 at 10:05
  • @dongseok0 That's correct, you cannot do this with the Microsoft Graph API (or with the Azure AD Graph API). You must use the [Azure REST API](https://learn.microsoft.com/en-us/rest/api/authorization/roleassignments/list) – Philippe Signoret Apr 23 '18 at 13:06
  • @PhilippeSignoret Is it possible to list Intune RBAC roles by Azure RBAC REST APIs? From my test with list API, it doesn't give anything related Intune. – dongseok0 Jul 23 '18 at 03:51
  • No, the Azure REST API will only list Azure RBAC roles. If you want Intune RBAC roles and assignments, you need to use Microsoft Graph (what you linked to in your original question). https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/resources/intune_rbac_conceptual – Philippe Signoret Jul 23 '18 at 09:04
  • @PhilippeSignoret Thanks! One last question - so that means, I have to fetch all the roleAssignments and filter them by groupId since graph API doesn't support $filter? – dongseok0 Jul 24 '18 at 02:53