How to list privileged role assignments in Azure

Before you start

Use an account that can read role assignments at the scopes you want to check. That is the Microsoft.Authorization/roleAssignments/read permission, which a role such as the built-in Reader has. Microsoft lists no separate licence for it. To show names, the account also needs to read the directory. Without that, PowerShell reports the principal type as Unknown and Microsoft's download leaves the name, sign-in name and type blank.

The examples read and export, and change nothing. They count 4 roles: Owner, Contributor, User Access Administrator and Role Based Access Control Administrator, the same 4 Altivane marks. Microsoft's list of privileged administrator roles also includes Reservations Administrator, so add it to $roles if you want it. Custom roles and Microsoft Entra roles such as Global Administrator are not counted, and the script does not list classic administrators.

Option 1

List privileged role assignments with PowerShell

Install the modules once. The script signs in, reads the role assignments of each enabled subscription, keeps the privileged roles and saves 1 row for each assignment.

Install-Module -Name Az.Accounts, Az.Resources -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$roles = @(
    'Owner'
    'Contributor'
    'User Access Administrator'
    'Role Based Access Control Administrator'
)
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptions = @(Get-AzSubscription | Where-Object State -eq 'Enabled')
    if ($subscriptions.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $found = @{}
    foreach ($sub in $subscriptions) {
        Set-AzContext -Subscription $sub.Id -Tenant $sub.TenantId -Scope Process | Out-Null
        Get-AzRoleAssignment -Scope "/subscriptions/$($sub.Id)" |
            Where-Object { $roles -contains $_.RoleDefinitionName } |
            ForEach-Object { $found[$_.RoleAssignmentId] = $_ }
    }
    $rows = @($found.Values | Sort-Object RoleDefinitionName, DisplayName)
    if ($rows.Count -eq 0) {
        Write-Output 'No privileged role assignments were found.'
    } else {
        $rows | Select-Object DisplayName, SignInName, ObjectType, RoleDefinitionName,
            Scope, ObjectId, RoleAssignmentId |
            Export-Csv -Path './privileged-role-assignments.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) assignments saved to privileged-role-assignments.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

Microsoft describes the scope filter as the assignments effective at that scope, which includes those inherited from above, so the script keeps each assignment ID once. The CSV holds the name, sign-in name, principal type, role, scope, object ID and assignment ID. The finally block disconnects the account and removes its saved Azure contexts, so you will need to sign in again.

To narrow the search, filter $subscriptions. To widen it, add role names to $roles. A row whose type is Group means every member of that group holds the role.

Option 2

List privileged role assignments in the Azure portal

1. Sign in to the Azure portal with an account that can read the subscription's role assignments.
2. Choose All services > Subscriptions, then select the subscription.
3. Choose Access control (IAM) > Role assignments.
4. Choose Privileged to list the privileged administrator role assignments at this scope.
5. To keep the list, choose Download role assignments, tick Inherited, At current scope and Children as needed, choose CSV or JSON and choose Start.

With a Microsoft Entra ID P2 or Governance licence, the portal may show active and eligible assignments separately. Microsoft's download leaves out assignments whose principal was deleted and classic administrators. This method suits 1 subscription at a time; for many, use PowerShell or Altivane.

Common questions

A group holds Owner. Who has it?

Every member of the group. To see 1 person's roles including those through groups, run Get-AzRoleAssignment -SignInName person@example.com -ExpandPrincipalGroups. Microsoft supports that switch for a user only.

Why is a name blank or the type Unknown?

PowerShell reports Unknown when the identity is not found or the account cannot read it. Check with an account that can read the directory before removing an assignment.

Does this include Global Administrator?

No. Azure roles control Azure resources, and Microsoft Entra roles control the directory. See how to list admin role assignments in Microsoft Entra ID.