Auditing Azure RBAC Assignments

I recently had a need to create a script to generate a report on Azure RBAC role assignments. The script does a number of things given the domain for your Azure AD tenant:

• Reports on which users or AD groups have which role;
• The scope that the role applies to (e.g. subscription, resource group, resource);
• Where the role is assigned to an AD group, it uses the function from this blog post to recursively obtain the group members http://spr.com/azure-arm-group-membership-recursively-part-1/
• The script reports on whether a user is Co-Administrator, Service Administrator or Account Administrator
• Report on whether a user is sourced from the Azure AD Tenant or an external directory or if it appears to be an external account

The user running the script must have permissions to read permissions e.g. 'Microsoft.Authorization/*/read' permissions

The script can either output the results as an array of custom objects or in CSV format which can then be redirected to a file and manipulated in Excel.

The script could be run as a scheduled task or via Azure Automation if you wanted to periodically run the script in an automated fashion, it can also be extended to alert on certain cases such as when users from outside your Azure AD Tenant have access to a subscription, resource group or individual resource. The latter item is not a default feature of the script as depending on your organisation you may legitimately have external accounts (e.g. if you're using 3rd parties to assist you with deploying/building or managing Azure).

The script has been published to my GitHub repo. Hopefully it will be of use to others.