Question 404657 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – Search-AzQuery querying authorizationresources returns 0 records

I want to query all the builtin Azure role definitions using Search-AzQuery. I have the Az.ResourceGroup module v1.0.0 installed.

This query works fine in the Azure Portal’s Azure Resource Graph Explorer and returns 5 records:

authorizationresources | where type == "microsoft.authorization/roledefinitions" | where properties["type"] == "BuiltInRole" | limit 5

If I run the same query locally using Search-AzQuery (or az graph query for that matter), I get zero records.

Search-AzGraph -Query 'authorizationresources | where type == "microsoft.authorization/roledefinitions" | where properties["type"] == "BuiltInRole" | limit 5'

However, if I remove the second where, then it does return records.

Search-AzGraph -Query 'authorizationresources | where type == "microsoft.authorization/roledefinitions" | limit 5'

I’ve also tried the =~ operator (to ignore case when comparing) but that makes no difference.

What am I doing wrong?

Tags:

2

Answers


  1. 0

    When you run in local you should not run like the way you run, you will get 0 records as below:

    enter image description here

    To get correct results, you have to use command as below and followed Microsoft-Document:

    az graph query -q "
authorizationresources 
| where type == 'microsoft.authorization/roledefinitions' 
| where properties['type'] == 'BuiltInRole' 
"

    enter image description here

    Also refer my answer in SO-Thread.

    Edit:

    Use this command :

    Search-AzGraph -Query " 
authorizationresources 
| where type =~ 'microsoft.authorization/roleassignments'
"

    Edit2:

    $rith = Search-AzGraph -Query "
authorizationresources
| where type =~ 'microsoft.authorization/roleassignments'
"
$rithwik = $rith | Where-Object { $_.properties.principalType -eq 'X' }
$rithwik
    Login or Signup to reply.
  2. 0

    You should add UseTenantScope, I tried a lot and found that this method works.

    Why it works:

    roledefinitions has the resource id some like this /providers/Microsoft.Authorization/RoleDefinitions/aabbc5dd-1af0-458b-a942-81af88f9c138, which not be related to a certain subscription.

    Search-AzGraph -Query "authorizationresources | where type == 'microsoft.authorization/roledefinitions' | where properties['type'] == 'BuiltInRole' | limit 5" -UseTenantScope
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search