How to get Users with Role permissions

Question

I am using this [subscription api][https://management.azure.com/subscriptions?api-version=2020-01-01] to get the azure subscription details. but in the response we are getting authorization source has role based. How can we fetch the users present in that subscription and what are there permissions(ex- owner, reader)

You can use this API to get all role assignment of your subscription:docs.microsoft.com/en-us/azure/role-based-access-control/… But it is not so convenient as you can only get user ID and role defination ID, you will need to do some other actions if you want to get user and role display name. It will be much easier to get all the information you want if you use Azure PowerShell. — Stanley Gong
Welcome, so do you have any more questions about it? If not, I'll summarize it as an answer :) — Stanley Gong
@StanleyGong you have mentioned that we need to do some other actions to get user and role display name please can i know what are that actions? — Krishnareddy Chinthireddy
Hi @KrishnareddyChinthireddy, Sure, I have posted all steps to get Azure subscription role assignments. Could you pls accept it if it helps you? — Stanley Gong

Stanley Gong Stanley Gong · Accepted Answer · 2021-02-16T09:18:20

Firstly, you can use this API to get the role assignment of your subscription, just as below:

Each item record presents a role assignment. And you can find roleDefinitionId which means the role you assigned and principalId means the role assigned to which Azure AD app or user.

So if you want to get the details about the role information, you should call the API below sparately:

GET https://management.azure.com/<value of roleDefinitionId>?api-version=2018-07-01

And if you want to get the details information of principalId, you should call Microsoft Graph API : get directory object just as below:

If you just want to query a user/Azure ad application is assigned with subscription roles, it will be much easier as This API provides a $filter param for us, lets say if you have a user's object ID, you can filter this user's role by request below:

How to get Users with Role permissions

1 Answers