azure-roles-digger.sh

Mon, 16 Mar 2026 00:00:00 +0000

The problem

Azure permission auditing is a special kind of hell.

You run az role assignment list and get back… direct assignments. That’s it. No inherited roles from group nesting. No Entra ID directory roles. No PIM-eligible roles sitting there waiting to be activated. Nothing about what that service principal can actually do when you trace the full chain.

So you’re left clicking through 15 portal blades, running separate Graph queries, cross-referencing group memberships by hand, piecing it all together in a spreadsheet like it’s 2005. And after 30 minutes you’re still not sure you found everything.

Rbac on ioctl

azure-roles-digger.sh

The problem