How can you see the user that is assigned the Role in an ARM (Bicep) deployment.

Question

I have this Bicep code which creates an Azure Databricks access connector and then gives Reader Role to some Service Principal that have been given as an input in the parameters.

resource accessConnector 'Microsoft.Databricks/accessConnectors@2022-04-01-preview' = {
  name: name
  location: location
  tags: tags
  identity: {
    type: 'SystemAssigned'
  }
}

resource roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for spId in accessConnectorConsumersSPs: {
  name: guid(accessConnector.id, spId)  
  scope: accessConnector  
  properties: {
    principalId: spId  
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')  // Reader
    principalType: 'ServicePrincipal'
  }
}]

Here i have two issues:

1. In case the Role has been already given, the template gives an error that the role assignment already exists. This doesn't seem like an issue that should be caused, but it has also been mentioned before in another question.
2. The main problem is that in this case, there is no way to see which user has the appropriate permission in the portal. When i try to see the deployment, in the operation details i can see the Resource Id of the Databricks access connector (scope), but i cannot see to which user it refers to.

As a workaround, I found the service principal IDs in the Inputs and checked the role assignment details for the successful ones to identify the failed assignments. However, this approach is not ideal, especially for cases with multiple role assignments. Is there a better way to troubleshoot this deployment?

Answer 1

@Aris

Thanks for reaching out to Microsoft Q&A.

When working with Azure Resource Manager (ARM) templates or Bicep deployments, managing role assignments can sometimes lead to challenges, especially when it comes to identifying which users or service principals have been assigned specific roles. Here are some suggestions to address the issues you've raised:

Handling Role Assignment Conflicts

To avoid errors when a role assignment already exists, you can use the existing keyword in Bicep to check if the role assignment already exists before attempting to create it. However, this can be complex since Bicep does not natively support conditional resource creation based on the existence of other resources. Instead, you can handle this in a few ways:

Use a Deployment Script: You can use an Azure CLI or PowerShell script to check for existing role assignments before deploying the Bicep template. This way, you can conditionally create role assignments only if they do not already exist.

Use if Conditions: If you have a way to determine whether a role assignment should be created (e.g., based on a parameter), you can use an if condition in your Bicep code to control the creation of the role assignment.

Identifying Role Assignments in the Azure Portal

To see which service principals have been assigned roles in the Azure portal, you can follow these steps:

Azure Portal: Navigate to the resource (in your case, the Databricks access connector) in the Azure portal. Under the "Access control (IAM)" section, you can view the role assignments. This will show you the principal (user or service principal) that has been assigned the role.

Azure CLI or PowerShell: You can use Azure CLI or PowerShell to list role assignments for a specific resource. For example, using Azure CLI, you can run:

az role assignment list --scope <resource-id>

Replace <resource-id> with the ID of your Databricks access connector. This command will return a list of role assignments, including the principal IDs and their corresponding roles.

Improving Troubleshooting

To improve your troubleshooting process, consider the following:

Output Role Assignments: You can output the role assignments created in your Bicep template. This way, after deployment, you can easily see which service principals were assigned roles. For example:

output roleAssignments array = [for spId in accessConnectorConsumersSPs: {
  principalId: spId
  roleAssignmentId: guid(accessConnector.id, spId)
}]

Logging and Monitoring: Implement logging and monitoring for your deployments. Azure Activity Logs can provide insights into role assignment operations, including successes and failures.

Use Tags: If applicable, use tags on your role assignments to help identify them later. Tags can be useful for categorizing and filtering resources in the Azure portal.

By implementing these strategies, you should be able to manage role assignments more effectively and troubleshoot any issues that arise during your Bicep deployments.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.