az role assignment list - Failed to query xxxxxxxx by invoking Graph API

[helannivas]

Describe the bug

Hi,

I'm writing a cli command to list all the roles assigned under a user managed identity by running the below command

az role assignment list --assignee

but Im getting a warning as

Failed to query xxxxxxxx by invoking Graph API.If you dont have permission to query Graph API, please specifu --assignee-object-d and -assignee-principal-type

I tried running with --all parameter

az role assignment list --all

where I got output for all roles under each principalId.

I need to get the list for individual Principal Id. Please let me know what level of permission Im lagging to running this query

az role assignment list --assignee

Related command

az role assignment list --assignee
az role assignment list --all

Errors

Failed to query xxxxxxxx by invoking Graph API.If you dont have permission to query Graph API, please specifu --assignee-object-d and -assignee-principal-type

Issue script & Debug output

Failed to query xxxxxxxx by invoking Graph API.If you dont have permission to query Graph API, please specifu --assignee-object-d and -assignee-principal-type

Expected behavior

Output of roles assigned to user managed identity

Environment Summary

azure cli Version : 2.249.8

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az role assignment list: "Failed to resolve graph object information" with managed identity #20792
• 'az role assignment list' gives wrong feedback #21020

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

The error message 'Failed to query xxxxxxxx by invoking Graph API' means the logged-in account doesn't have graph permission. If it is a service principal, you may follow the instructions to give it AD Graph Directory.Read.All permission. This involves granting the service principal the necessary permissions to access the Graph API.

Reference:

• 'az role assignment list' gives wrong feedback #21020 (comment)

Solution 2:

Managed identity can't be granted Directory.Read.All permission. This permission can only be granted to a user account or a service principal account, not managed identity. Managed identity is only designed to access Azure resources, not Microsoft Graph or AD Graph.

Reference:

• az role assignment list: "Failed to resolve graph object information" with managed identity #20792 (comment)

[jiasli]

It is a known issue that az role assignment list doesn't support --assignee-object-id: #30436.

For now you may provide the GUID object ID (aka Principal ID) in --assignee and this will trigger the fallback logic:

azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py

Lines 1588 to 1590 in b912e02

	if fallback_to_object_id and is_guid(assignee):
	logger.warning('Assuming %s as an object ID.', assignee)
	return assignee, None

[jiasli]

Fixed by #30469