Power shell script which shows list of RBAC role, Azure resource and Username

printscreen Sorry, I've had a busy week at the office so haven't got back sooner.

With this script we can separate out the Group assignments from the user assignments by checking $RoleAssignment.ObjectType. I've used an if block in the following example. Once we have the group, Get-AzADGroupMember can be used to do a lookup on the group and then we can loop through those $GroupMembers and get the value for each.

Note that this code won't currently deal with nested groups (Get-AZADGroupMember doesn't have a -recursive option), but you should be able to find the code to do that with a quick search around if required.

foreach ($Resource in Get-AzResource) {
  $RoleAssignments=Get-AZRoleAssignment -ResourceGroupName $Resource.ResourceGroupName -ResourceName $Resource.Name -ResourceType $resource.type
  ForEach ($RoleAssignment in $RoleAssignments){
     if ($RoleAssignment.ObjectType -eq "Group"){
      #Role Assignment is a Group, list Group members
      $GroupMembers=Get-AzADGroupMember -GroupObjectId $RoleAssignment.ObjectID
      ForEach ($GroupMember in $GroupMembers){
       $Resource | Select-Object @{Name="Azure Resource name";Expression={$Resource.Name}},
       @{Name="SignInName";Expression={$GroupMember.UserPrincipalName}},
       @{Name="DisplayName";Expression={$GroupMember.DisplayName}},
       @{Name="RoleDefinitionName";Expression={$RoleAssignment.RoleDefinitionName}}
      }
     }else{
      #Not a Group- Treat as a User
     $Resource | Select-Object @{Name="Azure Resource name";Expression={$Resource.Name}},
       @{Name="SignInName";Expression={$RoleAssignment.SignInName}},
       @{Name="DisplayName";Expression={$RoleAssignment.DisplayName}},
       @{Name="RoleDefinitionName";Expression={$RoleAssignment.RoleDefinitionName}}
     }
   }
 }

ChrisBradshaw Ignore my previous script. I was just messing myself and trying out, but it doesn't display the individual members in the group. And hitting this error:

Get-AzADGroupMember : A parameter cannot be found that matches parameter name 'Name'.
At line:4 char:30

I'm sure there is some wrong with the line which I added, Is this something you can help with?

ChrisBradshawsomething like this?