PowerShell: Azure – Audit Who Has Owner Role Across All Subscriptions

Connect-AzAccount

.\Get-AzureOwnerAudit.ps1 -OutputPath "C:\Audits\azure-owners_2025-11-19.csv"

Auditing 14 subscription(s)...
Production - East  : 5 Owner row(s) (2 inherited, 2 subscription, 1 below)
Production - West  : 4 Owner row(s) (2 inherited, 1 subscription, 1 below)
Sandbox - Dev Team : 9 Owner row(s) (2 inherited, 6 subscription, 1 below)
...
61 row(s), 23 unique principal(s) across 14 of 14 subscription(s). Report written to C:\Audits\azure-owners_2025-11-19.csv

.\Get-AzureOwnerAudit.ps1 -OutputPath "C:\Audits\azure-owners_2025-11-19.csv" -IncludeEligible

$rows = Import-Csv -Path "C:\Audits\azure-owners_2025-11-19.csv"

$rows | Where-Object { $_.PrincipalType -eq "Unknown" } | Format-Table SubscriptionName, PrincipalObjectId, AssignmentScope
$rows | Where-Object { $_.ScopeLevel -eq "Subscription" -and $_.PrincipalType -eq "User" -and $_.AssignmentState -eq "Active" } | Format-Table SubscriptionName, PrincipalName
$rows | Where-Object { $_.PrincipalType -eq "ServicePrincipal" } | Sort-Object PrincipalName -Unique | Format-Table PrincipalName, AssignmentScope

<#
.SYNOPSIS
    Reports every Owner role assignment that affects each Azure subscription visible to the current session.
.DESCRIPTION
    Enumerates subscriptions with Get-AzSubscription and, for each one that is Enabled, Warned or
    PastDue (Disabled and Expired ones are counted and skipped), calls
    Get-AzRoleAssignment -RoleDefinitionName Owner in that subscription's context. Without a scope,
    Get-AzRoleAssignment returns assignments inherited from the root and management groups, assignments
    on the subscription, and assignments on resource groups and resources inside it; each row is labelled
    with ScopeLevel (Inherited, Subscription, ResourceGroup, Resource) so they can be told apart. Rows
    whose description matches the automatic classic administrator conversion are flagged. With
    -IncludeEligible, PIM-eligible Owner assignments are added from Get-AzRoleEligibilitySchedule, which
    Get-AzRoleAssignment does not return. Writes one CSV.
.PARAMETER OutputPath
    Path to write the CSV report.
.PARAMETER IncludeEligible
    Also reports PIM-eligible Owner assignments from Get-AzRoleEligibilitySchedule.
.EXAMPLE
    .\Get-AzureOwnerAudit.ps1 -OutputPath "C:\Audits\azure-owners_2025-11-19.csv" -IncludeEligible
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-11-19)
    Requires: Az.Accounts, Az.Resources, roleAssignments/read on every audited subscription
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)]
    [string]$OutputPath,

    [Parameter(Mandatory = $false)]
    [switch]$IncludeEligible
)

$ErrorActionPreference = 'Stop'

# Built-in Owner role definition ID (same in every tenant).
$ownerRoleId = "8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
$classicConversionText = "The Classic Admin role was converted to an Azure Owner role"

function Get-ScopeLevel {
    param([string]$Scope, [string]$SubscriptionScope)

    if ($Scope -eq "/" -or $Scope -like "/providers/Microsoft.Management/managementGroups/*") {
        return "Inherited"
    }
    if ($Scope -eq $SubscriptionScope) {
        return "Subscription"
    }
    if ($Scope -match "^/subscriptions/[^/]+/resourceGroups/[^/]+$") {
        return "ResourceGroup"
    }
    return "Resource"
}

$allSubscriptions = @(Get-AzSubscription)
$subscriptions = @($allSubscriptions | Where-Object { $_.State -in @("Enabled", "Warned", "PastDue") })
$inactiveCount = $allSubscriptions.Count - $subscriptions.Count
if ($inactiveCount -gt 0) {
    Write-Warning "Skipping $inactiveCount Disabled or Expired subscription(s)."
}
Write-Host "Auditing $($subscriptions.Count) subscription(s)..."

$results = [System.Collections.Generic.List[object]]::new()
$auditedCount = 0

foreach ($subscription in $subscriptions) {
    $subscriptionScope = "/subscriptions/$($subscription.Id)"

    try {
        Set-AzContext -SubscriptionId $subscription.Id | Out-Null
        $ownerAssignments = @(Get-AzRoleAssignment -RoleDefinitionName "Owner" |
            Where-Object { $_.RoleDefinitionId -like "*$ownerRoleId" })
    } catch {
        Write-Warning "Skipping '$($subscription.Name)': $($_.Exception.Message)"
        continue
    }
    $auditedCount++

    foreach ($assignment in $ownerAssignments) {
        $results.Add([PSCustomObject]@{
            SubscriptionName    = $subscription.Name
            SubscriptionId      = $subscription.Id
            PrincipalName       = $assignment.DisplayName
            SignInName          = $assignment.SignInName
            PrincipalType       = $assignment.ObjectType
            PrincipalObjectId   = $assignment.ObjectId
            AssignmentState     = "Active"
            AssignmentScope     = $assignment.Scope
            ScopeLevel          = Get-ScopeLevel -Scope $assignment.Scope -SubscriptionScope $subscriptionScope
            EndDateTime         = $null
            HasCondition        = -not [string]::IsNullOrEmpty($assignment.Condition)
            ClassicAdminConvert = "$($assignment.Description)" -like "$classicConversionText*"
        })
    }

    if ($IncludeEligible) {
        try {
            $eligible = @(Get-AzRoleEligibilitySchedule -Scope $subscriptionScope |
                Where-Object { $_.RoleDefinitionId -like "*$ownerRoleId" })
        } catch {
            Write-Warning "Could not read PIM eligibility for '$($subscription.Name)': $($_.Exception.Message)"
            $eligible = @()
        }

        foreach ($schedule in $eligible) {
            $results.Add([PSCustomObject]@{
                SubscriptionName    = $subscription.Name
                SubscriptionId      = $subscription.Id
                PrincipalName       = $schedule.PrincipalDisplayName
                SignInName          = $schedule.PrincipalEmail
                PrincipalType       = $schedule.PrincipalType
                PrincipalObjectId   = $schedule.PrincipalId
                AssignmentState     = "Eligible"
                AssignmentScope     = $schedule.Scope
                ScopeLevel          = Get-ScopeLevel -Scope $schedule.Scope -SubscriptionScope $subscriptionScope
                EndDateTime         = $schedule.EndDateTime
                HasCondition        = -not [string]::IsNullOrEmpty($schedule.Condition)
                ClassicAdminConvert = $false
            })
        }
    }

    $subscriptionRows = @($results | Where-Object { $_.SubscriptionId -eq $subscription.Id })
    $inheritedCount = @($subscriptionRows | Where-Object { $_.ScopeLevel -eq "Inherited" }).Count
    $directCount = @($subscriptionRows | Where-Object { $_.ScopeLevel -eq "Subscription" }).Count
    $belowCount = $subscriptionRows.Count - $inheritedCount - $directCount
    Write-Host "$($subscription.Name) : $($subscriptionRows.Count) Owner row(s) ($inheritedCount inherited, $directCount subscription, $belowCount below)"
}

$results | Export-Csv -Path $OutputPath -NoTypeInformation

$uniquePrincipals = @($results | Select-Object -ExpandProperty PrincipalObjectId -Unique).Count
Write-Host "$($results.Count) row(s), $uniquePrincipals unique principal(s) across $auditedCount of $($subscriptions.Count) subscription(s). Report written to $OutputPath"