'az role assignment list' gives wrong feedback

[wkoeter]

Context:
I need to clean up role assignments using CLI because Azure does not remove them itself when removing the identity.
When running the following command on an Azure DevOps Hosted Agent:

az role assignment list --assignee $principalId --all

Result
The CLI gives the following feedback:
Failed to query xxxx-xxxx-xxxx-xxxx by invoking Graph API. If you don't have permission to query Graph API, please specify --assignee-object-id and --assignee-principal-type.
WARNING: Assuming xxxx-xxxx-xxxx-xxxx as an object ID.

Problem:
assignee-object-id and assignee-principal-type are not valid parameters for az role assignment list.
If used. The following is returned:
unrecognized arguments: --assignee-principal-type ServicePrincipal --assignee-object-id xxxx-xxxx-xxxx-xxxx

(Thankfully using the principalId as ObjectId appearantly works. But we really want to get rid of the warnings in our DevOps dashboard..)

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 9dacfad8-cb2f-2534-3b29-89b0930a2252
• Version Independent ID: 17325cd4-44c5-4069-d9f6-940a55f0f7c9
• Content: az role assignment
• Content Source: latest/docs-ref-autogen/role/assignment.yml
• Service: azure-resource-manager
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

@jiasli for awareness

[jiasli]

The error message "Failed to query xxxx-xxxx-xxxx-xxxx by invoking Graph API" means the logged-in account doesn't have graph permission. If it is a service principal, you may follow #20792 (comment) to give it AD Graph Directory.Read.All permission.

assignee-object-id and assignee-principal-type are not valid parameters for az role assignment list.

This seems like a bug of the warning message. Functionality-wise, it works as expected. We should make az role assignment list accept --assignee-object-id to bypass Graph call.

Thankfully using the principalId as ObjectId appearantly works.

Yes, using principalId as objectId in --assignee should work as expected.

But we really want to get rid of the warnings in our DevOps dashboard

You may use --only-show-errors to turn off the warning.

[wkoeter]

Hi thanks for the quick and insightful reply!
Yes it is a service principal, we will look into whether we can give it the permissions.
We will not use the flag for showing only errors, since we dont want to miss any warnings that do matter.