Description
Remove-AzDenyAssignment always prompts for confirmation interactively, even when invoked with -Confirm:$false or with $ConfirmPreference = 'None' set in the session. This makes the cmdlet impossible to use in any non-interactive automation (CI pipelines, smoke tests, scheduled jobs, etc.).
The cmdlet is decorated with SupportsShouldProcess and ConfirmImpact = High (or equivalent), which should mean -Confirm:$false suppresses the prompt — but it does not.
Repro
Tested against the Debug build from PR #29340 (Az.Resources 9.0.3) in PowerShell 7 on Windows.
Import-Module C:\src\azure-powershell\artifacts\Debug\Az.Resources\Az.Resources.psd1 -Force
Connect-AzAccount -Tenant <tenant> -Subscription <sub>
$ConfirmPreference = 'None'
$da = New-AzDenyAssignment -Scope "/subscriptions/<sub>" -DenyAssignmentName "test" `
-Description "test" -Action @("Microsoft.Storage/storageAccounts/delete") `
-Principal @{ Id = "<user-oid>"; Type = "User" }
# This still prompts:
Remove-AzDenyAssignment -Id $da.Id -Confirm:$false
# Confirm
# Are you sure you want to remove deny assignment '...'? [Y] Yes [N] No ...Expected
-Confirm:$false (and/or $ConfirmPreference = 'None') suppresses the prompt and the cmdlet performs the delete silently, matching standard SupportsShouldProcess behavior in every other Az cmdlet (e.g. Remove-AzRoleAssignment).
Actual
Prompt always appears regardless of -Confirm:$false, -Force, or $ConfirmPreference.
Impact
- Blocks all automated testing of the new UADA delete path
- Will block PowerShell GA — customers cannot script
Remove-AzDenyAssignment
Related
Description
Remove-AzDenyAssignmentalways prompts for confirmation interactively, even when invoked with-Confirm:$falseor with$ConfirmPreference = 'None'set in the session. This makes the cmdlet impossible to use in any non-interactive automation (CI pipelines, smoke tests, scheduled jobs, etc.).The cmdlet is decorated with
SupportsShouldProcessandConfirmImpact = High(or equivalent), which should mean-Confirm:$falsesuppresses the prompt — but it does not.Repro
Tested against the Debug build from PR #29340 (
Az.Resources9.0.3) in PowerShell 7 on Windows.Expected
-Confirm:$false(and/or$ConfirmPreference = 'None') suppresses the prompt and the cmdlet performs the delete silently, matching standardSupportsShouldProcessbehavior in every other Az cmdlet (e.g.Remove-AzRoleAssignment).Actual
Prompt always appears regardless of
-Confirm:$false,-Force, or$ConfirmPreference.Impact
Remove-AzDenyAssignmentRelated
*-AzDenyAssignmentcmdlets for user-assigned deny assignments (UADA)