Edit

Share via

Remove-AzRoleAssignment

Module:
Az.Resources Module

Removes a role assignment to the specified principal who is assigned to a particular role at a particular scope.

The cmdlet may call below Microsoft Graph API according to input parameters:

  • GET /users/{id}
  • GET /servicePrincipals/{id}
  • GET /groups/{id}
  • GET /directoryObjects/{id}
  • POST /directoryObjects/getByIds

Please notice that this cmdlet will mark ObjectType as Unknown in output if the object of role assignment is not found or current account has insufficient privileges to get object type.

Syntax

EmptyParameterSet (Default) 

Remove-AzRoleAssignment
    -ObjectId <String>
    -RoleDefinitionName <String>
    [-Scope <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ResourceWithObjectIdParameterSet 

Remove-AzRoleAssignment
    -ObjectId <String>
    -ResourceGroupName <String>
    -ResourceName <String>
    -ResourceType <String>
    -RoleDefinitionName <String>
    [-ParentResource <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ResourceGroupWithObjectIdParameterSet 

Remove-AzRoleAssignment
    -ObjectId <String>
    -ResourceGroupName <String>
    -RoleDefinitionName <String>
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ScopeWithObjectIdParameterSet 

Remove-AzRoleAssignment
    -ObjectId <String>
    -RoleDefinitionName <String>
    [-Scope <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

RoleIdWithScopeAndObjectIdParameterSet 

Remove-AzRoleAssignment
    -ObjectId <String>
    -RoleDefinitionId <Guid>
    [-Scope <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ResourceWithSignInNameParameterSet 

Remove-AzRoleAssignment
    -SignInName <String>
    -ResourceGroupName <String>
    -ResourceName <String>
    -ResourceType <String>
    -RoleDefinitionName <String>
    [-ParentResource <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ResourceGroupWithSignInNameParameterSet 

Remove-AzRoleAssignment
    -SignInName <String>
    -ResourceGroupName <String>
    -RoleDefinitionName <String>
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ScopeWithSignInNameParameterSet 

Remove-AzRoleAssignment
    -SignInName <String>
    -RoleDefinitionName <String>
    [-Scope <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ResourceWithSPNParameterSet 

Remove-AzRoleAssignment
    -ServicePrincipalName <String>
    -ResourceGroupName <String>
    -ResourceName <String>
    -ResourceType <String>
    -RoleDefinitionName <String>
    [-ParentResource <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ResourceGroupWithSPNParameterSet 

Remove-AzRoleAssignment
    -ServicePrincipalName <String>
    -ResourceGroupName <String>
    -RoleDefinitionName <String>
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ScopeWithSPNParameterSet 

Remove-AzRoleAssignment
    -ServicePrincipalName <String>
    -RoleDefinitionName <String>
    [-Scope <String>]
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

RoleAssignmentParameterSet 

Remove-AzRoleAssignment
    [-InputObject] <PSRoleAssignment>
    [-PassThru]
    [-SkipClientSideScopeValidation]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

Use the Remove-AzRoleAssignment commandlet to revoke access to any principal at given scope and given role. The object of the assignment i.e. the principal MUST be specified. The principal can be a user (use SignInName or ObjectId parameters to identify a user), security group (use ObjectId parameter to identify a group) or service principal (use ServicePrincipalName or ObjectId parameters to identify a ServicePrincipal. The role that the principal is assigned to MUST be specified using the RoleDefinitionName parameter. The scope of the assignment MAY be specified and if not specified, defaults to the subscription scope i.e. it will try to delete an assignment to the specified principal and role at the subscription scope. The scope of the assignment can be specified using one of the following parameters. a. Scope - This is the fully qualified scope starting with /subscriptions/<subscriptionId> b. ResourceGroupName - Name of any resource group under the subscription. c. ResourceName, ResourceType, ResourceGroupName and (optionally) ParentResource - Identifies a particular resource under the subscription.

Examples

Example 1

Remove-AzRoleAssignment -ResourceGroupName rg1 -SignInName john.doe@contoso.com -RoleDefinitionName Reader

Removes a role assignment for john.doe@contoso.com who is assigned to the Reader role at the rg1 resourcegroup scope.

Example 2

Remove-AzRoleAssignment -ObjectId 00001111-aaaa-2222-bbbb-3333cccc4444 -RoleDefinitionName Reader

Removes the role assignment to the group principal identified by the ObjectId and assigned to the Reader role. Defaults to using the current subscription as the scope to find the assignment to be deleted.

Example 3

$roleassignment = Get-AzRoleAssignment |Select-Object -First 1 -Wait
Remove-AzRoleAssignment -InputObject $roleassignment

Removes the first role assignment object which is fetched from the Get-AzRoleAssignment commandlet.

Parameters

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:cf

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with azure

Parameter properties

Type:IAzureContextContainer
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AzContext, AzureRmContext, AzureCredential

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-InputObject

Role Assignment object.

Parameter properties

Type:PSRoleAssignment
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

RoleAssignmentParameterSet
Position:0
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False

-ObjectId

Microsoft Entra ObjectId of the user, group or service principal.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False
Aliases:Id, PrincipalId

Parameter sets

EmptyParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
RoleIdWithScopeAndObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-ParentResource

The parent resource in the hierarchy(of the resource specified using ResourceName parameter), if any. Must be used in conjunction with ResourceGroupName, ResourceType and ResourceName parameters to construct a hierarchical scope in the form of a relative URI that identifies the resource.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

ResourceWithObjectIdParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSignInNameParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSPNParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-PassThru

If specified, displays the deleted role assignment

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ResourceGroupName

The resource group name that the role is assigned to. Attempts to delete an assignment at the specified resource group scope. When used in conjunction with ResourceName, ResourceType and (optionally)ParentResource parameters, the command constructs a hierarchical scope in the form of a relative URI that identifies a resource.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

ResourceWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-ResourceName

The resource name. For e.g. storageaccountprod. Must be used in conjunction with ResourceGroupName, ResourceType and (optionally)ParentResource parameters, to construct a hierarchical scope in the form of a relative URI that identifies the resource and delete an assignment at that scope.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

ResourceWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-ResourceType

The resource type. For e.g. Microsoft.Network/virtualNetworks. Must be used in conjunction with ResourceGroupName, ResourceName and (optionally)ParentResource parameters to construct a hierarchical scope in the form of a relative URI that identifies the resource and delete an assignment at that resource scope.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

ResourceWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-RoleDefinitionId

Id of the RBAC role for which the assignment needs to be deleted.

Parameter properties

Type:Guid
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

RoleIdWithScopeAndObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-RoleDefinitionName

Name of the RBAC role for which the assignment needs to be deleted i.e. Reader, Contributor, Virtual Network Administrator, etc.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

EmptyParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithObjectIdParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-Scope

The Scope of the role assignment to be deleted. In the format of relative URI. For e.g. "/subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG". If not specified, will attempt to delete the role at subscription level. If specified, it should start with "/subscriptions/{id}".

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

EmptyParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithObjectIdParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
RoleIdWithScopeAndObjectIdParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithSignInNameParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithSPNParameterSet
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-ServicePrincipalName

The ServicePrincipalName of the Microsoft Entra application

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False
Aliases:SPN, ApplicationId

Parameter sets

ResourceWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithSPNParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-SignInName

The email address or the user principal name of the user.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False
Aliases:Email, UserPrincipalName

Parameter sets

ResourceWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ResourceGroupWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False
ScopeWithSignInNameParameterSet
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:True
Value from remaining arguments:False

-SkipClientSideScopeValidation

If specified, skip client side scope validation.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-WhatIf

Use the Remove-AzRoleAssignment commandlet to revoke access to any principal at given scope and given role. The object of the assignment i.e. the principal MUST be specified. The principal can be a user (use SignInName or ObjectId parameters to identify a user), security group (use ObjectId parameter to identify a group) or service principal (use ServicePrincipalName or ObjectId parameters to identify a ServicePrincipal. The role that the principal is assigned to MUST be specified using the RoleDefinitionName parameter. The scope of the assignment MAY be specified and if not specified, defaults to the subscription scope i.e. it will try to delete an assignment to the specified principal and role at the subscription scope. The scope of the assignment can be specified using one of the following parameters. a. Scope - This is the fully qualified scope starting with /subscriptions/<subscriptionId> b. ResourceGroupName - Name of any resource group under the subscription. c. ResourceName, ResourceType, ResourceGroupName and (optionally) ParentResource - Identifies a particular resource under the subscription.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:wi

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

String

Guid

PSRoleAssignment

Outputs

PSRoleAssignment

Notes

Keywords: azure, azurerm, arm, resource, management, manager, resource, group, template, deployment