Open ghost opened 4 years ago
I didn't find any issue in my environment.
Scope should be specific to one resource. The return is all role assignment on that resource. In addition, role assignment is inherited from parent.
Thanks for getting back to me. I'm really struggling with this one. In the attachment I define the Scope on Resource Group level. Why do I get the role assignments on the resource level (marked yellow), that would be below.
Some role is created when you create resource. In addition, this role is assigned to resource group to ensure function can work (effective assignment). If you just need role's original scope equals to your specific one, you need to filter them by powershell script.
Got it, but then I would think you would have to adjust the documentation since scope gets all roles from above AND BELOW.
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc
Please update documentation, it's still not updated
Description
With regards to the Scope parameter the documentation states "This is the fully qualified scope starting with
/subscriptions/<subscriptionId>
. This will filter assignments that are effective at that particular scope i.e. all assignments at that scope and above."However, when executing with a subscription ID or a resource group ID the assignments below are also displayed.
Steps to reproduce
Environment data
Module versions
Debug output
Error output