Get-AzDenyAssignment

參考

模組:: Az.Resources

列出指定範圍中的 Azure RBAC 拒絕指派。根據預設，它會列出所選 Azure 訂用帳戶中的所有拒絕指派。使用個別參數來列出特定用戶的拒絕指派，或列出特定資源群組或資源上的拒絕指派。

Cmdlet 可能會根據輸入參數呼叫下列Microsoft圖形 API：

GET /directoryObjects/{id}
POST /directoryObjects/getByIds

語法

Get-AzDenyAssignment
   [-Scope <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ObjectId <Guid>
   [-ExpandPrincipalGroups]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ObjectId <Guid>
   -ResourceGroupName <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ObjectId <Guid>
   -ResourceGroupName <String>
   -ResourceName <String>
   -ResourceType <String>
   [-ParentResource <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ObjectId <Guid>
   -Scope <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -SignInName <String>
   -ResourceGroupName <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -SignInName <String>
   -ResourceGroupName <String>
   -ResourceName <String>
   -ResourceType <String>
   [-ParentResource <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -SignInName <String>
   -Scope <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -SignInName <String>
   [-ExpandPrincipalGroups]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ServicePrincipalName <String>
   -ResourceGroupName <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ServicePrincipalName <String>
   -ResourceGroupName <String>
   -ResourceName <String>
   -ResourceType <String>
   [-ParentResource <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ServicePrincipalName <String>
   -Scope <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ServicePrincipalName <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ResourceGroupName <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -ResourceGroupName <String>
   -ResourceName <String>
   -ResourceType <String>
   [-ParentResource <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   -Scope <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   [-Scope <String>]
   -Id <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Get-AzDenyAssignment
   [-Scope <String>]
   -DenyAssignmentName <String>
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Description

使用 Get-AzDenyAssignment 命令來列出在範圍上生效的所有拒絕指派。如果沒有任何參數，此命令會傳回訂用帳戶下所做的所有拒絕指派。您可以使用主體篩選參數、拒絕指派名稱和範圍來篩選此清單。若要指定使用者，請使用 SignInName 或 Microsoft Entra ObjectId 參數。若要指定安全組，請使用 Microsoft Entra ObjectId 參數。若要指定Microsoft Entra 應用程式，請使用 ServicePrincipalName 或 ObjectId 參數。可以指定拒絕存取的範圍。默認為選取的訂用帳戶。您可以使用下列其中一個參數組合來指定拒絕指派的範圍。範圍 - 這是從 /subscriptions/<subscriptionId>開始的完整範圍。這會篩選在特定範圍生效的拒絕指派，亦即該範圍和更新版本的所有拒絕指派。 b. ResourceGroupName - 訂用帳戶下任何資源群組的名稱。這會篩選指定資源群組的有效指派，也就是該範圍和更新版本的所有拒絕指派。 c. ResourceName、ResourceType、ResourceGroupName 和（選擇性地） ParentResource - 識別訂用帳戶底下的特定資源，並將篩選出在該資源範圍內有效的拒絕指派。若要判斷訂用帳戶中特定用戶拒絕的存取權，請使用 ExpandPrincipalGroups 參數。這會列出指派給使用者的所有拒絕指派，以及指派給用戶所屬的群組。

範例

範例 1

列出訂用帳戶中的所有拒絕指派

Get-AzDenyAssignment

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/denyAssignments/22704996-fbd0-4ab1-8625-722d897825d2
DenyAssignmentName      : Test deny assignment 1
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  All Principals
                          ObjectType:   SystemDefined
                          ObjectId:     00000000-0000-0000-0000-000000000000
                          }
ExcludePrincipals       : {
                          DisplayName:  testuser
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          }
IsSystemProtected       : True

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName      : Test deny assignment 2
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  testuser
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          ,
                          DisplayName:  PowershellTestingApp
                          ObjectType:   ServicePrincipal
                          ObjectId:     f2dc21ac-702a-4bde-a4ce-146edf751d81
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

範例 2

取得對使用者所做的所有拒絕指派，john.doe@contoso.com 範圍testRG和更新版本。

Get-AzDenyAssignment -ResourceGroupName testRG -SignInName john.doe@contoso.com

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/denyAssignments/22704996-fbd0-4ab1-8625-722d897825d2
DenyAssignmentName      : Test deny assignment 1
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  john.doe
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName      : Test deny assignment
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  john.doe
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          ,
                          DisplayName:  PowershellTestingApp
                          ObjectType:   ServicePrincipal
                          ObjectId:     f2dc21ac-702a-4bde-a4ce-146edf751d81
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

範例 3

取得指定服務主體的所有拒絕指派

Get-AzDenyAssignment -ServicePrincipalName 'http://testapp1.com'

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName      : Test deny assignment 1
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  TestApp
                          ObjectType:   ServicePrincipal
                          ObjectId:     f2dc21ac-702a-4bde-a4ce-146edf751d81
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1/providers/Microsoft.Authorization/denyAssignments/94e3d9da-3700-4113-aab4-15f6c173d794
DenyAssignmentName      : Test deny assignment 2
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  testuser
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          ,
                          DisplayName:  TestApp
                          ObjectType:   ServicePrincipal
                          ObjectId:     f2dc21ac-702a-4bde-a4ce-146edf751d81
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

範例 4

取得『site1』網站範圍的拒絕指派。

Get-AzDenyAssignment -Scope '/subscriptions/96231a05-34ce-4eb4-aa6a-70759cbb5e83/resourcegroups/testRG/providers/Microsoft.Web/sites/site1'

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG/providers/Microsoft.Authorization/denyAssignments/43af7d0c-0bf8-407f-96c0-96a29d076431
DenyAssignmentName      : Test deny assignment 1
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourcegroups/testRG
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  testuser
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

Id                      : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1/providers/Microsoft.Authorization/denyAssignments/594e3d9da-3700-4113-aab4-15f6c173d794
DenyAssignmentName      : Test deny assignment 2
Description             : Test deny assignment for PS cmdlets
Actions                 : {foo/*}
NotActions              : {foo/*/read}
DataActions             : {foo/*}
NotDataActions          : {}
Scope                   : /subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/testRG/providers/Microsoft.Web/sites/site1
DoNotApplyToChildScopes : False
Principals              : {
                          DisplayName:  testuser
                          ObjectType:   User
                          ObjectId:     f8d526a0-54eb-4941-ae69-ebf4a334d0f0
                          ,
                          DisplayName:  TestApp
                          ObjectType:   ServicePrincipal
                          ObjectId:     f2dc21ac-702a-4bde-a4ce-146edf751d81
                          }
ExcludePrincipals       : {}
IsSystemProtected       : True

參數

-DefaultProfile

用於與 azure 通訊的認證、帳戶、租用戶和訂用帳戶

類型:	IAzureContextContainer
別名:	AzContext, AzureRmContext, AzureCredential
Position:	Named
預設值:	None
必要:	False
接受管線輸入:	False
接受萬用字元:	False

-DenyAssignmentName

拒絕指派的名稱。

類型:	String
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-ExpandPrincipalGroups

如果指定，則會傳回直接指派給使用者和使用者所屬群組的拒絕指派（可轉移）。僅支援用戶主體。

類型:	SwitchParameter
Position:	Named
預設值:	None
必要:	False
接受管線輸入:	False
接受萬用字元:	False

-Id

拒絕指派完整標識碼或 GUID。當標識碼以 GUID 的形式提供時，會將目前的訂用帳戶視為預設範圍。

類型:	String
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-ObjectId

使用者、群組或服務主體的 Microsoft Entra ObjectId。篩選對指定主體所做的所有拒絕指派。

類型:	Nullable<T>[Guid]
別名:	PrincipalId
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-ParentResource

使用 ResourceName 參數指定之資源階層中的父資源。必須與 ResourceGroupName、ResourceType 和 ResourceName 參數搭配使用。

類型:	String
Position:	Named
預設值:	None
必要:	False
接受管線輸入:	True
接受萬用字元:	False

-ResourceGroupName

資源組名。列出在指定資源群組上生效的拒絕指派。搭配 ResourceName、ResourceType 和 ParentResource 參數使用時，命令會列出資源群組內資源有效的拒絕指派。

類型:	String
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-ResourceName

資源名稱。例如 storageaccountprod。必須與 ResourceGroupName、ResourceType 和（選擇性）ParentResource 參數搭配使用。

類型:	String
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-ResourceType

資源類型。例如，Microsoft.Network/virtualNetworks。必須與 ResourceGroupName、ResourceName 和（選擇性）ParentResource 參數搭配使用。

類型:	String
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-Scope

角色指派的範圍。以相對 URI 的格式。例如 /subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG。它必須以 “/subscriptions/{id}” 開頭。命令會篩選在該範圍內生效的所有拒絕指派。

類型:	String
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-ServicePrincipalName

服務主體的 ServicePrincipalName。篩選對指定之Microsoft Entra 應用程式所做的所有拒絕指派。

類型:	String
別名:	SPN
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

-SignInName

用戶的電子郵件地址或用戶主體名稱。篩選對指定使用者所做的所有拒絕指派。

類型:	String
別名:	Email, UserPrincipalName
Position:	Named
預設值:	None
必要:	True
接受管線輸入:	True
接受萬用字元:	False

輸入

Guid

String

輸出

PSDenyAssignment

備註

關鍵詞：azure， azurerm， arm，資源，管理，管理員，資源，群組，範本，部署

共用方式為