Retrieve List of Users with Access to Sentinel?

[danielmasters]

Hi all,

I've been working on retrieving a list of users who have access to Sentinel.

So far I've only found using Get-AzRoleAssignment to be fairly useful, but so far running it against every subscription seems to be the best way.

Does anyone know of any other better methods to retrieve a list of users, direct/indirect (including from RBAC groups) with access to Sentinel?

Regards

Dan

[#2]

I would think you need to check the Resource Groups that contains the Log Analytics workspace as permissions could be granted at that level and not just at the subscription level.

[#3]

That's a good point. I'm using PIM as well, so turns out Get-AzRoleAssignment isn't the entire solution. It's a fairly involved task and not just "exporting users for Sentinel" as per requested by audit....