[{"data":1,"prerenderedAt":2344},["ShallowReactive",2],{"post:\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions\u002F":3},{"post":4,"newer":2296,"older":2305,"related":2314,"series":2342},{"id":5,"title":6,"body":7,"canonical":2278,"categories":2279,"date":2282,"description":2283,"extension":2284,"featured":2285,"hero":2286,"image":2286,"meta":2287,"navigation":187,"path":2288,"readingTime":322,"seo":2289,"series":2286,"seriesOrder":2286,"sites":2290,"source":2286,"stem":2291,"tags":2292,"updated":2286,"url":2294,"__hash__":2295},"blog\u002Fblog\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions.md","PowerShell: Azure – Audit Who Has Owner Role Across All Subscriptions",{"type":8,"value":9,"toc":2270},"minimark",[10,20,25,93,97,157,161,164,209,217,220,243,246,426,430,2079,2083,2208,2212,2266],[11,12,13,14,19],"p",{},"Owner is the role everyone means to review quarterly and almost nobody does, because doing it by hand means clicking into every subscription's Access Control blade one at a time. Assignments also pile up from management-group inheritance, so a principal can be an Owner on a subscription without any assignment visible on that subscription at all, and PIM-eligible Owners don't show up in the usual list until they activate. This script enumerates every subscription the running credential can see, pulls every Owner assignment that affects it (inherited from above, on the subscription, or on a resource group or resource inside it), optionally adds PIM-eligible Owners, and flattens the result into one CSV so you can actually review it. It pairs with the access model in ",[15,16,18],"a",{"href":17},"\u002F2026\u002F04\u002F15\u002Fazure-landing-zone-design-for-a-mid-size-company-three-years-in\u002F","Azure: Landing Zone Design for a Mid-Size Company, Three Years In",", where Owner is supposed to live only at a handful of scopes.",[21,22,24],"h2",{"id":23},"requirements","Requirements",[26,27,28,48,71,86],"ul",{},[29,30,31,32,36,37,40,41,44,45,47],"li",{},"PowerShell 7.x with the ",[33,34,35],"code",{},"Az.Accounts"," and ",[33,38,39],{},"Az.Resources"," modules (the PIM cmdlets ",[33,42,43],{},"Get-AzRoleEligibilitySchedule"," ship in ",[33,46,39],{},").",[29,49,50,53,54,58,59,63,64,70],{},[33,51,52],{},"Microsoft.Authorization\u002FroleAssignments\u002Fread"," on every subscription you want audited. ",[55,56,57],"strong",{},"Reader on the Tenant Root Group"," (the root management group) covers every management group and subscription in the tenant in one assignment. Note that the Entra ID ",[60,61,62],"em",{},"Global Reader"," role does not grant this: it is a directory role, not an Azure RBAC role. A Global Administrator who lacks Azure access can temporarily ",[15,65,69],{"href":66,"rel":67},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Frole-based-access-control\u002Felevate-access-global-admin",[68],"nofollow","elevate access"," to get User Access Administrator at root, grant Reader, and remove the elevation.",[29,72,73,74,77,78,81,82,85],{},"Directory read access in Microsoft Graph so ",[33,75,76],{},"Get-AzRoleAssignment"," can resolve display names and object types. Without it, rows come back with ",[33,79,80],{},"ObjectType"," set to ",[33,83,84],{},"Unknown",".",[29,87,88,89,92],{},"An authenticated Az session (",[33,90,91],{},"Connect-AzAccount","), interactively or as a service principal for scheduled runs.",[21,94,96],{"id":95},"parameters","Parameters",[98,99,100,119],"table",{},[101,102,103],"thead",{},[104,105,106,110,113,116],"tr",{},[107,108,109],"th",{},"Name",[107,111,112],{},"Type",[107,114,115],{},"Required",[107,117,118],{},"Description",[120,121,122,139],"tbody",{},[104,123,124,130,133,136],{},[125,126,127],"td",{},[33,128,129],{},"OutputPath",[125,131,132],{},"String",[125,134,135],{},"Yes",[125,137,138],{},"Path to write the CSV report.",[104,140,141,146,149,152],{},[125,142,143],{},[33,144,145],{},"IncludeEligible",[125,147,148],{},"Switch",[125,150,151],{},"No",[125,153,154,155,85],{},"Also reports PIM-eligible Owner assignments from ",[33,156,43],{},[21,158,160],{"id":159},"usage","Usage",[11,162,163],{},"Sign in and run the audit against every subscription visible to the session:",[165,166,171],"pre",{"className":167,"code":168,"language":169,"meta":170,"style":170},"language-powershell shiki shiki-themes github-dark","Connect-AzAccount\n\n.\\Get-AzureOwnerAudit.ps1 -OutputPath \"C:\\Audits\\azure-owners_2025-11-19.csv\"\n","powershell","",[33,172,173,182,189],{"__ignoreMap":170},[174,175,178],"span",{"class":176,"line":177},"line",1,[174,179,181],{"class":180},"sDLfK","Connect-AzAccount\n",[174,183,185],{"class":176,"line":184},2,[174,186,188],{"emptyLinePlaceholder":187},true,"\n",[174,190,192,195,198,202,205],{"class":176,"line":191},3,[174,193,85],{"class":194},"s95oV",[174,196,197],{"class":180},"\\Get-AzureOwnerAudit.ps1",[174,199,201],{"class":200},"snl16"," -",[174,203,204],{"class":194},"OutputPath ",[174,206,208],{"class":207},"sU2Wk","\"C:\\Audits\\azure-owners_2025-11-19.csv\"\n",[165,210,215],{"className":211,"code":213,"language":214,"meta":170},[212],"language-text","Auditing 14 subscription(s)...\nProduction - East  : 5 Owner row(s) (2 inherited, 2 subscription, 1 below)\nProduction - West  : 4 Owner row(s) (2 inherited, 1 subscription, 1 below)\nSandbox - Dev Team : 9 Owner row(s) (2 inherited, 6 subscription, 1 below)\n...\n61 row(s), 23 unique principal(s) across 14 of 14 subscription(s). Report written to C:\\Audits\\azure-owners_2025-11-19.csv\n","text",[33,216,213],{"__ignoreMap":170},[11,218,219],{},"Add PIM-eligible Owners, which the plain role assignment list never shows:",[165,221,223],{"className":167,"code":222,"language":169,"meta":170,"style":170},".\\Get-AzureOwnerAudit.ps1 -OutputPath \"C:\\Audits\\azure-owners_2025-11-19.csv\" -IncludeEligible\n",[33,224,225],{"__ignoreMap":170},[174,226,227,229,231,233,235,238,240],{"class":176,"line":177},[174,228,85],{"class":194},[174,230,197],{"class":180},[174,232,201],{"class":200},[174,234,204],{"class":194},[174,236,237],{"class":207},"\"C:\\Audits\\azure-owners_2025-11-19.csv\"",[174,239,201],{"class":200},[174,241,242],{"class":194},"IncludeEligible\n",[11,244,245],{},"Then triage the CSV. Start with rows nobody can explain: unresolved principals (usually deleted accounts), direct user assignments at subscription scope, and service principals holding Owner:",[165,247,249],{"className":167,"code":248,"language":169,"meta":170,"style":170},"$rows = Import-Csv -Path \"C:\\Audits\\azure-owners_2025-11-19.csv\"\n\n$rows | Where-Object { $_.PrincipalType -eq \"Unknown\" } | Format-Table SubscriptionName, PrincipalObjectId, AssignmentScope\n$rows | Where-Object { $_.ScopeLevel -eq \"Subscription\" -and $_.PrincipalType -eq \"User\" -and $_.AssignmentState -eq \"Active\" } | Format-Table SubscriptionName, PrincipalName\n$rows | Where-Object { $_.PrincipalType -eq \"ServicePrincipal\" } | Sort-Object PrincipalName -Unique | Format-Table PrincipalName, AssignmentScope\n",[33,250,251,269,273,320,379],{"__ignoreMap":170},[174,252,253,256,259,262,264,267],{"class":176,"line":177},[174,254,255],{"class":194},"$rows ",[174,257,258],{"class":200},"=",[174,260,261],{"class":180}," Import-Csv",[174,263,201],{"class":200},[174,265,266],{"class":194},"Path ",[174,268,208],{"class":207},[174,270,271],{"class":176,"line":184},[174,272,188],{"emptyLinePlaceholder":187},[174,274,275,277,280,283,286,289,292,295,298,301,303,306,309,312,315,317],{"class":176,"line":191},[174,276,255],{"class":194},[174,278,279],{"class":200},"|",[174,281,282],{"class":180}," Where-Object",[174,284,285],{"class":194}," { ",[174,287,288],{"class":180},"$_",[174,290,291],{"class":194},".PrincipalType ",[174,293,294],{"class":200},"-eq",[174,296,297],{"class":207}," \"Unknown\"",[174,299,300],{"class":194}," } ",[174,302,279],{"class":200},[174,304,305],{"class":180}," Format-Table",[174,307,308],{"class":194}," SubscriptionName",[174,310,311],{"class":200},",",[174,313,314],{"class":194}," PrincipalObjectId",[174,316,311],{"class":200},[174,318,319],{"class":194}," AssignmentScope\n",[174,321,323,325,327,329,331,333,336,338,341,344,347,349,351,354,356,358,361,363,366,368,370,372,374,376],{"class":176,"line":322},4,[174,324,255],{"class":194},[174,326,279],{"class":200},[174,328,282],{"class":180},[174,330,285],{"class":194},[174,332,288],{"class":180},[174,334,335],{"class":194},".ScopeLevel ",[174,337,294],{"class":200},[174,339,340],{"class":207}," \"Subscription\"",[174,342,343],{"class":200}," -and",[174,345,346],{"class":180}," $_",[174,348,291],{"class":194},[174,350,294],{"class":200},[174,352,353],{"class":207}," \"User\"",[174,355,343],{"class":200},[174,357,346],{"class":180},[174,359,360],{"class":194},".AssignmentState ",[174,362,294],{"class":200},[174,364,365],{"class":207}," \"Active\"",[174,367,300],{"class":194},[174,369,279],{"class":200},[174,371,305],{"class":180},[174,373,308],{"class":194},[174,375,311],{"class":200},[174,377,378],{"class":194}," PrincipalName\n",[174,380,382,384,386,388,390,392,394,396,399,401,403,406,409,412,415,417,419,422,424],{"class":176,"line":381},5,[174,383,255],{"class":194},[174,385,279],{"class":200},[174,387,282],{"class":180},[174,389,285],{"class":194},[174,391,288],{"class":180},[174,393,291],{"class":194},[174,395,294],{"class":200},[174,397,398],{"class":207}," \"ServicePrincipal\"",[174,400,300],{"class":194},[174,402,279],{"class":200},[174,404,405],{"class":180}," Sort-Object",[174,407,408],{"class":194}," PrincipalName ",[174,410,411],{"class":200},"-",[174,413,414],{"class":194},"Unique ",[174,416,279],{"class":200},[174,418,305],{"class":180},[174,420,421],{"class":194}," PrincipalName",[174,423,311],{"class":200},[174,425,319],{"class":194},[21,427,429],{"id":428},"script","Script",[165,431,433],{"className":167,"code":432,"language":169,"meta":170,"style":170},"\u003C#\n.SYNOPSIS\n    Reports every Owner role assignment that affects each Azure subscription visible to the current session.\n.DESCRIPTION\n    Enumerates subscriptions with Get-AzSubscription and, for each one that is Enabled, Warned or\n    PastDue (Disabled and Expired ones are counted and skipped), calls\n    Get-AzRoleAssignment -RoleDefinitionName Owner in that subscription's context. Without a scope,\n    Get-AzRoleAssignment returns assignments inherited from the root and management groups, assignments\n    on the subscription, and assignments on resource groups and resources inside it; each row is labelled\n    with ScopeLevel (Inherited, Subscription, ResourceGroup, Resource) so they can be told apart. Rows\n    whose description matches the automatic classic administrator conversion are flagged. With\n    -IncludeEligible, PIM-eligible Owner assignments are added from Get-AzRoleEligibilitySchedule, which\n    Get-AzRoleAssignment does not return. Writes one CSV.\n.PARAMETER OutputPath\n    Path to write the CSV report.\n.PARAMETER IncludeEligible\n    Also reports PIM-eligible Owner assignments from Get-AzRoleEligibilitySchedule.\n.EXAMPLE\n    .\\Get-AzureOwnerAudit.ps1 -OutputPath \"C:\\Audits\\azure-owners_2025-11-19.csv\" -IncludeEligible\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2025-11-19)\n    Requires: Az.Accounts, Az.Resources, roleAssignments\u002Fread on every audited subscription\n#>\n[CmdletBinding()]\nparam(\n    [Parameter(Mandatory = $true)]\n    [string]$OutputPath,\n\n    [Parameter(Mandatory = $false)]\n    [switch]$IncludeEligible\n)\n\n$ErrorActionPreference = 'Stop'\n\n# Built-in Owner role definition ID (same in every tenant).\n$ownerRoleId = \"8e3af657-a8ff-443c-a75c-2fe8c4bcb635\"\n$classicConversionText = \"The Classic Admin role was converted to an Azure Owner role\"\n\nfunction Get-ScopeLevel {\n    param([string]$Scope, [string]$SubscriptionScope)\n\n    if ($Scope -eq \"\u002F\" -or $Scope -like \"\u002Fproviders\u002FMicrosoft.Management\u002FmanagementGroups\u002F*\") {\n        return \"Inherited\"\n    }\n    if ($Scope -eq $SubscriptionScope) {\n        return \"Subscription\"\n    }\n    if ($Scope -match \"^\u002Fsubscriptions\u002F[^\u002F]+\u002FresourceGroups\u002F[^\u002F]+$\") {\n        return \"ResourceGroup\"\n    }\n    return \"Resource\"\n}\n\n$allSubscriptions = @(Get-AzSubscription)\n$subscriptions = @($allSubscriptions | Where-Object { $_.State -in @(\"Enabled\", \"Warned\", \"PastDue\") })\n$inactiveCount = $allSubscriptions.Count - $subscriptions.Count\nif ($inactiveCount -gt 0) {\n    Write-Warning \"Skipping $inactiveCount Disabled or Expired subscription(s).\"\n}\nWrite-Host \"Auditing $($subscriptions.Count) subscription(s)...\"\n\n$results = [System.Collections.Generic.List[object]]::new()\n$auditedCount = 0\n\nforeach ($subscription in $subscriptions) {\n    $subscriptionScope = \"\u002Fsubscriptions\u002F$($subscription.Id)\"\n\n    try {\n        Set-AzContext -SubscriptionId $subscription.Id | Out-Null\n        $ownerAssignments = @(Get-AzRoleAssignment -RoleDefinitionName \"Owner\" |\n            Where-Object { $_.RoleDefinitionId -like \"*$ownerRoleId\" })\n    } catch {\n        Write-Warning \"Skipping '$($subscription.Name)': $($_.Exception.Message)\"\n        continue\n    }\n    $auditedCount++\n\n    foreach ($assignment in $ownerAssignments) {\n        $results.Add([PSCustomObject]@{\n            SubscriptionName    = $subscription.Name\n            SubscriptionId      = $subscription.Id\n            PrincipalName       = $assignment.DisplayName\n            SignInName          = $assignment.SignInName\n            PrincipalType       = $assignment.ObjectType\n            PrincipalObjectId   = $assignment.ObjectId\n            AssignmentState     = \"Active\"\n            AssignmentScope     = $assignment.Scope\n            ScopeLevel          = Get-ScopeLevel -Scope $assignment.Scope -SubscriptionScope $subscriptionScope\n            EndDateTime         = $null\n            HasCondition        = -not [string]::IsNullOrEmpty($assignment.Condition)\n            ClassicAdminConvert = \"$($assignment.Description)\" -like \"$classicConversionText*\"\n        })\n    }\n\n    if ($IncludeEligible) {\n        try {\n            $eligible = @(Get-AzRoleEligibilitySchedule -Scope $subscriptionScope |\n                Where-Object { $_.RoleDefinitionId -like \"*$ownerRoleId\" })\n        } catch {\n            Write-Warning \"Could not read PIM eligibility for '$($subscription.Name)': $($_.Exception.Message)\"\n            $eligible = @()\n        }\n\n        foreach ($schedule in $eligible) {\n            $results.Add([PSCustomObject]@{\n                SubscriptionName    = $subscription.Name\n                SubscriptionId      = $subscription.Id\n                PrincipalName       = $schedule.PrincipalDisplayName\n                SignInName          = $schedule.PrincipalEmail\n                PrincipalType       = $schedule.PrincipalType\n                PrincipalObjectId   = $schedule.PrincipalId\n                AssignmentState     = \"Eligible\"\n                AssignmentScope     = $schedule.Scope\n                ScopeLevel          = Get-ScopeLevel -Scope $schedule.Scope -SubscriptionScope $subscriptionScope\n                EndDateTime         = $schedule.EndDateTime\n                HasCondition        = -not [string]::IsNullOrEmpty($schedule.Condition)\n                ClassicAdminConvert = $false\n            })\n        }\n    }\n\n    $subscriptionRows = @($results | Where-Object { $_.SubscriptionId -eq $subscription.Id })\n    $inheritedCount = @($subscriptionRows | Where-Object { $_.ScopeLevel -eq \"Inherited\" }).Count\n    $directCount = @($subscriptionRows | Where-Object { $_.ScopeLevel -eq \"Subscription\" }).Count\n    $belowCount = $subscriptionRows.Count - $inheritedCount - $directCount\n    Write-Host \"$($subscription.Name) : $($subscriptionRows.Count) Owner row(s) ($inheritedCount inherited, $directCount subscription, $belowCount below)\"\n}\n\n$results | Export-Csv -Path $OutputPath -NoTypeInformation\n\n$uniquePrincipals = @($results | Select-Object -ExpandProperty PrincipalObjectId -Unique).Count\nWrite-Host \"$($results.Count) row(s), $uniquePrincipals unique principal(s) across $auditedCount of $($subscriptions.Count) subscription(s). Report written to $OutputPath\"\n",[33,434,435,441,448,453,460,465,471,477,483,489,495,501,507,513,524,530,540,546,554,560,568,574,580,586,592,604,613,638,652,657,675,686,692,697,708,713,719,730,741,746,759,783,788,817,826,832,844,852,857,872,880,885,894,900,905,923,970,986,1003,1018,1023,1046,1051,1072,1083,1088,1103,1126,1131,1139,1155,1180,1207,1218,1252,1258,1263,1272,1277,1291,1309,1320,1331,1342,1353,1364,1375,1386,1397,1417,1428,1446,1479,1485,1490,1495,1503,1511,1533,1555,1565,1596,1608,1614,1619,1633,1647,1657,1667,1678,1689,1700,1711,1722,1733,1752,1763,1780,1791,1797,1802,1807,1812,1841,1872,1900,1921,1970,1975,1980,2000,2005,2032],{"__ignoreMap":170},[174,436,437],{"class":176,"line":177},[174,438,440],{"class":439},"sAwPA","\u003C#\n",[174,442,443,445],{"class":176,"line":184},[174,444,85],{"class":180},[174,446,447],{"class":200},"SYNOPSIS\n",[174,449,450],{"class":176,"line":191},[174,451,452],{"class":439},"    Reports every Owner role assignment that affects each Azure subscription visible to the current session.\n",[174,454,455,457],{"class":176,"line":322},[174,456,85],{"class":180},[174,458,459],{"class":200},"DESCRIPTION\n",[174,461,462],{"class":176,"line":381},[174,463,464],{"class":439},"    Enumerates subscriptions with Get-AzSubscription and, for each one that is Enabled, Warned or\n",[174,466,468],{"class":176,"line":467},6,[174,469,470],{"class":439},"    PastDue (Disabled and Expired ones are counted and skipped), calls\n",[174,472,474],{"class":176,"line":473},7,[174,475,476],{"class":439},"    Get-AzRoleAssignment -RoleDefinitionName Owner in that subscription's context. Without a scope,\n",[174,478,480],{"class":176,"line":479},8,[174,481,482],{"class":439},"    Get-AzRoleAssignment returns assignments inherited from the root and management groups, assignments\n",[174,484,486],{"class":176,"line":485},9,[174,487,488],{"class":439},"    on the subscription, and assignments on resource groups and resources inside it; each row is labelled\n",[174,490,492],{"class":176,"line":491},10,[174,493,494],{"class":439},"    with ScopeLevel (Inherited, Subscription, ResourceGroup, Resource) so they can be told apart. Rows\n",[174,496,498],{"class":176,"line":497},11,[174,499,500],{"class":439},"    whose description matches the automatic classic administrator conversion are flagged. With\n",[174,502,504],{"class":176,"line":503},12,[174,505,506],{"class":439},"    -IncludeEligible, PIM-eligible Owner assignments are added from Get-AzRoleEligibilitySchedule, which\n",[174,508,510],{"class":176,"line":509},13,[174,511,512],{"class":439},"    Get-AzRoleAssignment does not return. Writes one CSV.\n",[174,514,516,518,521],{"class":176,"line":515},14,[174,517,85],{"class":180},[174,519,520],{"class":200},"PARAMETER",[174,522,523],{"class":200}," OutputPath\n",[174,525,527],{"class":176,"line":526},15,[174,528,529],{"class":439},"    Path to write the CSV report.\n",[174,531,533,535,537],{"class":176,"line":532},16,[174,534,85],{"class":180},[174,536,520],{"class":200},[174,538,539],{"class":200}," IncludeEligible\n",[174,541,543],{"class":176,"line":542},17,[174,544,545],{"class":439},"    Also reports PIM-eligible Owner assignments from Get-AzRoleEligibilitySchedule.\n",[174,547,549,551],{"class":176,"line":548},18,[174,550,85],{"class":180},[174,552,553],{"class":200},"EXAMPLE\n",[174,555,557],{"class":176,"line":556},19,[174,558,559],{"class":439},"    .\\Get-AzureOwnerAudit.ps1 -OutputPath \"C:\\Audits\\azure-owners_2025-11-19.csv\" -IncludeEligible\n",[174,561,563,565],{"class":176,"line":562},20,[174,564,85],{"class":180},[174,566,567],{"class":200},"NOTES\n",[174,569,571],{"class":176,"line":570},21,[174,572,573],{"class":439},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[174,575,577],{"class":176,"line":576},22,[174,578,579],{"class":439},"    Version : 1.0 (2025-11-19)\n",[174,581,583],{"class":176,"line":582},23,[174,584,585],{"class":439},"    Requires: Az.Accounts, Az.Resources, roleAssignments\u002Fread on every audited subscription\n",[174,587,589],{"class":176,"line":588},24,[174,590,591],{"class":439},"#>\n",[174,593,595,598,601],{"class":176,"line":594},25,[174,596,597],{"class":194},"[",[174,599,600],{"class":180},"CmdletBinding",[174,602,603],{"class":194},"()]\n",[174,605,607,610],{"class":176,"line":606},26,[174,608,609],{"class":200},"param",[174,611,612],{"class":194},"(\n",[174,614,616,619,622,625,629,632,635],{"class":176,"line":615},27,[174,617,618],{"class":194},"    [",[174,620,621],{"class":180},"Parameter",[174,623,624],{"class":194},"(",[174,626,628],{"class":627},"s9osk","Mandatory",[174,630,631],{"class":200}," =",[174,633,634],{"class":180}," $true",[174,636,637],{"class":194},")]\n",[174,639,641,643,646,649],{"class":176,"line":640},28,[174,642,618],{"class":194},[174,644,645],{"class":200},"string",[174,647,648],{"class":194},"]$OutputPath",[174,650,651],{"class":200},",\n",[174,653,655],{"class":176,"line":654},29,[174,656,188],{"emptyLinePlaceholder":187},[174,658,660,662,664,666,668,670,673],{"class":176,"line":659},30,[174,661,618],{"class":194},[174,663,621],{"class":180},[174,665,624],{"class":194},[174,667,628],{"class":627},[174,669,631],{"class":200},[174,671,672],{"class":180}," $false",[174,674,637],{"class":194},[174,676,678,680,683],{"class":176,"line":677},31,[174,679,618],{"class":194},[174,681,682],{"class":200},"switch",[174,684,685],{"class":194},"]$IncludeEligible\n",[174,687,689],{"class":176,"line":688},32,[174,690,691],{"class":194},")\n",[174,693,695],{"class":176,"line":694},33,[174,696,188],{"emptyLinePlaceholder":187},[174,698,700,703,705],{"class":176,"line":699},34,[174,701,702],{"class":180},"$ErrorActionPreference",[174,704,631],{"class":200},[174,706,707],{"class":207}," 'Stop'\n",[174,709,711],{"class":176,"line":710},35,[174,712,188],{"emptyLinePlaceholder":187},[174,714,716],{"class":176,"line":715},36,[174,717,718],{"class":439},"# Built-in Owner role definition ID (same in every tenant).\n",[174,720,722,725,727],{"class":176,"line":721},37,[174,723,724],{"class":194},"$ownerRoleId ",[174,726,258],{"class":200},[174,728,729],{"class":207}," \"8e3af657-a8ff-443c-a75c-2fe8c4bcb635\"\n",[174,731,733,736,738],{"class":176,"line":732},38,[174,734,735],{"class":194},"$classicConversionText ",[174,737,258],{"class":200},[174,739,740],{"class":207}," \"The Classic Admin role was converted to an Azure Owner role\"\n",[174,742,744],{"class":176,"line":743},39,[174,745,188],{"emptyLinePlaceholder":187},[174,747,749,752,756],{"class":176,"line":748},40,[174,750,751],{"class":200},"function",[174,753,755],{"class":754},"svObZ"," Get-ScopeLevel",[174,757,758],{"class":194}," {\n",[174,760,762,765,768,770,773,775,778,780],{"class":176,"line":761},41,[174,763,764],{"class":200},"    param",[174,766,767],{"class":194},"([",[174,769,645],{"class":200},[174,771,772],{"class":194},"]$Scope",[174,774,311],{"class":200},[174,776,777],{"class":194}," [",[174,779,645],{"class":200},[174,781,782],{"class":194},"]$SubscriptionScope)\n",[174,784,786],{"class":176,"line":785},42,[174,787,188],{"emptyLinePlaceholder":187},[174,789,791,794,797,799,802,805,808,811,814],{"class":176,"line":790},43,[174,792,793],{"class":200},"    if",[174,795,796],{"class":194}," ($Scope ",[174,798,294],{"class":200},[174,800,801],{"class":207}," \"\u002F\"",[174,803,804],{"class":200}," -or",[174,806,807],{"class":194}," $Scope ",[174,809,810],{"class":200},"-like",[174,812,813],{"class":207}," \"\u002Fproviders\u002FMicrosoft.Management\u002FmanagementGroups\u002F*\"",[174,815,816],{"class":194},") {\n",[174,818,820,823],{"class":176,"line":819},44,[174,821,822],{"class":200},"        return",[174,824,825],{"class":207}," \"Inherited\"\n",[174,827,829],{"class":176,"line":828},45,[174,830,831],{"class":194},"    }\n",[174,833,835,837,839,841],{"class":176,"line":834},46,[174,836,793],{"class":200},[174,838,796],{"class":194},[174,840,294],{"class":200},[174,842,843],{"class":194}," $SubscriptionScope) {\n",[174,845,847,849],{"class":176,"line":846},47,[174,848,822],{"class":200},[174,850,851],{"class":207}," \"Subscription\"\n",[174,853,855],{"class":176,"line":854},48,[174,856,831],{"class":194},[174,858,860,862,864,867,870],{"class":176,"line":859},49,[174,861,793],{"class":200},[174,863,796],{"class":194},[174,865,866],{"class":200},"-match",[174,868,869],{"class":207}," \"^\u002Fsubscriptions\u002F[^\u002F]+\u002FresourceGroups\u002F[^\u002F]+$\"",[174,871,816],{"class":194},[174,873,875,877],{"class":176,"line":874},50,[174,876,822],{"class":200},[174,878,879],{"class":207}," \"ResourceGroup\"\n",[174,881,883],{"class":176,"line":882},51,[174,884,831],{"class":194},[174,886,888,891],{"class":176,"line":887},52,[174,889,890],{"class":200},"    return",[174,892,893],{"class":207}," \"Resource\"\n",[174,895,897],{"class":176,"line":896},53,[174,898,899],{"class":194},"}\n",[174,901,903],{"class":176,"line":902},54,[174,904,188],{"emptyLinePlaceholder":187},[174,906,908,911,913,916,918,921],{"class":176,"line":907},55,[174,909,910],{"class":194},"$allSubscriptions ",[174,912,258],{"class":200},[174,914,915],{"class":200}," @",[174,917,624],{"class":194},[174,919,920],{"class":180},"Get-AzSubscription",[174,922,691],{"class":194},[174,924,926,929,931,933,936,938,940,942,944,947,950,952,954,957,959,962,964,967],{"class":176,"line":925},56,[174,927,928],{"class":194},"$subscriptions ",[174,930,258],{"class":200},[174,932,915],{"class":200},[174,934,935],{"class":194},"($allSubscriptions ",[174,937,279],{"class":200},[174,939,282],{"class":180},[174,941,285],{"class":194},[174,943,288],{"class":180},[174,945,946],{"class":194},".State ",[174,948,949],{"class":200},"-in",[174,951,915],{"class":200},[174,953,624],{"class":194},[174,955,956],{"class":207},"\"Enabled\"",[174,958,311],{"class":200},[174,960,961],{"class":207}," \"Warned\"",[174,963,311],{"class":200},[174,965,966],{"class":207}," \"PastDue\"",[174,968,969],{"class":194},") })\n",[174,971,973,976,978,981,983],{"class":176,"line":972},57,[174,974,975],{"class":194},"$inactiveCount ",[174,977,258],{"class":200},[174,979,980],{"class":194}," $allSubscriptions.Count ",[174,982,411],{"class":200},[174,984,985],{"class":194}," $subscriptions.Count\n",[174,987,989,992,995,998,1001],{"class":176,"line":988},58,[174,990,991],{"class":200},"if",[174,993,994],{"class":194}," ($inactiveCount ",[174,996,997],{"class":200},"-gt",[174,999,1000],{"class":180}," 0",[174,1002,816],{"class":194},[174,1004,1006,1009,1012,1015],{"class":176,"line":1005},59,[174,1007,1008],{"class":180},"    Write-Warning",[174,1010,1011],{"class":207}," \"Skipping ",[174,1013,1014],{"class":194},"$inactiveCount",[174,1016,1017],{"class":207}," Disabled or Expired subscription(s).\"\n",[174,1019,1021],{"class":176,"line":1020},60,[174,1022,899],{"class":194},[174,1024,1026,1029,1032,1035,1037,1040,1043],{"class":176,"line":1025},61,[174,1027,1028],{"class":180},"Write-Host",[174,1030,1031],{"class":207}," \"Auditing ",[174,1033,1034],{"class":200},"$",[174,1036,624],{"class":207},[174,1038,1039],{"class":194},"$subscriptions.Count",[174,1041,1042],{"class":207},")",[174,1044,1045],{"class":207}," subscription(s)...\"\n",[174,1047,1049],{"class":176,"line":1048},62,[174,1050,188],{"emptyLinePlaceholder":187},[174,1052,1054,1057,1059,1061,1064,1066,1069],{"class":176,"line":1053},63,[174,1055,1056],{"class":194},"$results ",[174,1058,258],{"class":200},[174,1060,777],{"class":194},[174,1062,1063],{"class":200},"System.Collections.Generic.List",[174,1065,597],{"class":194},[174,1067,1068],{"class":200},"object",[174,1070,1071],{"class":194},"]]::new()\n",[174,1073,1075,1078,1080],{"class":176,"line":1074},64,[174,1076,1077],{"class":194},"$auditedCount ",[174,1079,258],{"class":200},[174,1081,1082],{"class":180}," 0\n",[174,1084,1086],{"class":176,"line":1085},65,[174,1087,188],{"emptyLinePlaceholder":187},[174,1089,1091,1094,1097,1100],{"class":176,"line":1090},66,[174,1092,1093],{"class":200},"foreach",[174,1095,1096],{"class":194}," ($subscription ",[174,1098,1099],{"class":200},"in",[174,1101,1102],{"class":194}," $subscriptions) {\n",[174,1104,1106,1109,1111,1114,1116,1118,1121,1123],{"class":176,"line":1105},67,[174,1107,1108],{"class":194},"    $subscriptionScope ",[174,1110,258],{"class":200},[174,1112,1113],{"class":207}," \"\u002Fsubscriptions\u002F",[174,1115,1034],{"class":200},[174,1117,624],{"class":207},[174,1119,1120],{"class":194},"$subscription.Id",[174,1122,1042],{"class":207},[174,1124,1125],{"class":207},"\"\n",[174,1127,1129],{"class":176,"line":1128},68,[174,1130,188],{"emptyLinePlaceholder":187},[174,1132,1134,1137],{"class":176,"line":1133},69,[174,1135,1136],{"class":200},"    try",[174,1138,758],{"class":194},[174,1140,1142,1145,1147,1150,1152],{"class":176,"line":1141},70,[174,1143,1144],{"class":180},"        Set-AzContext",[174,1146,201],{"class":200},[174,1148,1149],{"class":194},"SubscriptionId $subscription.Id ",[174,1151,279],{"class":200},[174,1153,1154],{"class":180}," Out-Null\n",[174,1156,1158,1161,1163,1165,1167,1169,1171,1174,1177],{"class":176,"line":1157},71,[174,1159,1160],{"class":194},"        $ownerAssignments ",[174,1162,258],{"class":200},[174,1164,915],{"class":200},[174,1166,624],{"class":194},[174,1168,76],{"class":180},[174,1170,201],{"class":200},[174,1172,1173],{"class":194},"RoleDefinitionName ",[174,1175,1176],{"class":207},"\"Owner\"",[174,1178,1179],{"class":200}," |\n",[174,1181,1183,1186,1188,1190,1193,1195,1198,1201,1204],{"class":176,"line":1182},72,[174,1184,1185],{"class":180},"            Where-Object",[174,1187,285],{"class":194},[174,1189,288],{"class":180},[174,1191,1192],{"class":194},".RoleDefinitionId ",[174,1194,810],{"class":200},[174,1196,1197],{"class":207}," \"*",[174,1199,1200],{"class":194},"$ownerRoleId",[174,1202,1203],{"class":207},"\"",[174,1205,1206],{"class":194}," })\n",[174,1208,1210,1213,1216],{"class":176,"line":1209},73,[174,1211,1212],{"class":194},"    } ",[174,1214,1215],{"class":200},"catch",[174,1217,758],{"class":194},[174,1219,1221,1224,1227,1229,1231,1234,1236,1239,1241,1243,1245,1248,1250],{"class":176,"line":1220},74,[174,1222,1223],{"class":180},"        Write-Warning",[174,1225,1226],{"class":207}," \"Skipping '",[174,1228,1034],{"class":200},[174,1230,624],{"class":207},[174,1232,1233],{"class":194},"$subscription.Name",[174,1235,1042],{"class":207},[174,1237,1238],{"class":207},"': ",[174,1240,1034],{"class":200},[174,1242,624],{"class":207},[174,1244,288],{"class":180},[174,1246,1247],{"class":194},".Exception.Message",[174,1249,1042],{"class":207},[174,1251,1125],{"class":207},[174,1253,1255],{"class":176,"line":1254},75,[174,1256,1257],{"class":200},"        continue\n",[174,1259,1261],{"class":176,"line":1260},76,[174,1262,831],{"class":194},[174,1264,1266,1269],{"class":176,"line":1265},77,[174,1267,1268],{"class":194},"    $auditedCount",[174,1270,1271],{"class":200},"++\n",[174,1273,1275],{"class":176,"line":1274},78,[174,1276,188],{"emptyLinePlaceholder":187},[174,1278,1280,1283,1286,1288],{"class":176,"line":1279},79,[174,1281,1282],{"class":200},"    foreach",[174,1284,1285],{"class":194}," ($assignment ",[174,1287,1099],{"class":200},[174,1289,1290],{"class":194}," $ownerAssignments) {\n",[174,1292,1294,1297,1300,1303,1306],{"class":176,"line":1293},80,[174,1295,1296],{"class":194},"        $results.Add([",[174,1298,1299],{"class":200},"PSCustomObject",[174,1301,1302],{"class":194},"]",[174,1304,1305],{"class":200},"@",[174,1307,1308],{"class":194},"{\n",[174,1310,1312,1315,1317],{"class":176,"line":1311},81,[174,1313,1314],{"class":194},"            SubscriptionName    ",[174,1316,258],{"class":200},[174,1318,1319],{"class":194}," $subscription.Name\n",[174,1321,1323,1326,1328],{"class":176,"line":1322},82,[174,1324,1325],{"class":194},"            SubscriptionId      ",[174,1327,258],{"class":200},[174,1329,1330],{"class":194}," $subscription.Id\n",[174,1332,1334,1337,1339],{"class":176,"line":1333},83,[174,1335,1336],{"class":194},"            PrincipalName       ",[174,1338,258],{"class":200},[174,1340,1341],{"class":194}," $assignment.DisplayName\n",[174,1343,1345,1348,1350],{"class":176,"line":1344},84,[174,1346,1347],{"class":194},"            SignInName          ",[174,1349,258],{"class":200},[174,1351,1352],{"class":194}," $assignment.SignInName\n",[174,1354,1356,1359,1361],{"class":176,"line":1355},85,[174,1357,1358],{"class":194},"            PrincipalType       ",[174,1360,258],{"class":200},[174,1362,1363],{"class":194}," $assignment.ObjectType\n",[174,1365,1367,1370,1372],{"class":176,"line":1366},86,[174,1368,1369],{"class":194},"            PrincipalObjectId   ",[174,1371,258],{"class":200},[174,1373,1374],{"class":194}," $assignment.ObjectId\n",[174,1376,1378,1381,1383],{"class":176,"line":1377},87,[174,1379,1380],{"class":194},"            AssignmentState     ",[174,1382,258],{"class":200},[174,1384,1385],{"class":207}," \"Active\"\n",[174,1387,1389,1392,1394],{"class":176,"line":1388},88,[174,1390,1391],{"class":194},"            AssignmentScope     ",[174,1393,258],{"class":200},[174,1395,1396],{"class":194}," $assignment.Scope\n",[174,1398,1400,1403,1405,1407,1409,1412,1414],{"class":176,"line":1399},89,[174,1401,1402],{"class":194},"            ScopeLevel          ",[174,1404,258],{"class":200},[174,1406,755],{"class":180},[174,1408,201],{"class":200},[174,1410,1411],{"class":194},"Scope $assignment.Scope ",[174,1413,411],{"class":200},[174,1415,1416],{"class":194},"SubscriptionScope $subscriptionScope\n",[174,1418,1420,1423,1425],{"class":176,"line":1419},90,[174,1421,1422],{"class":194},"            EndDateTime         ",[174,1424,258],{"class":200},[174,1426,1427],{"class":180}," $null\n",[174,1429,1431,1434,1436,1439,1441,1443],{"class":176,"line":1430},91,[174,1432,1433],{"class":194},"            HasCondition        ",[174,1435,258],{"class":200},[174,1437,1438],{"class":200}," -not",[174,1440,777],{"class":194},[174,1442,645],{"class":200},[174,1444,1445],{"class":194},"]::IsNullOrEmpty($assignment.Condition)\n",[174,1447,1449,1452,1454,1457,1459,1461,1464,1466,1468,1471,1473,1476],{"class":176,"line":1448},92,[174,1450,1451],{"class":194},"            ClassicAdminConvert ",[174,1453,258],{"class":200},[174,1455,1456],{"class":207}," \"",[174,1458,1034],{"class":200},[174,1460,624],{"class":207},[174,1462,1463],{"class":194},"$assignment.Description",[174,1465,1042],{"class":207},[174,1467,1203],{"class":207},[174,1469,1470],{"class":200}," -like",[174,1472,1456],{"class":207},[174,1474,1475],{"class":194},"$classicConversionText",[174,1477,1478],{"class":207},"*\"\n",[174,1480,1482],{"class":176,"line":1481},93,[174,1483,1484],{"class":194},"        })\n",[174,1486,1488],{"class":176,"line":1487},94,[174,1489,831],{"class":194},[174,1491,1493],{"class":176,"line":1492},95,[174,1494,188],{"emptyLinePlaceholder":187},[174,1496,1498,1500],{"class":176,"line":1497},96,[174,1499,793],{"class":200},[174,1501,1502],{"class":194}," ($IncludeEligible) {\n",[174,1504,1506,1509],{"class":176,"line":1505},97,[174,1507,1508],{"class":200},"        try",[174,1510,758],{"class":194},[174,1512,1514,1517,1519,1521,1523,1525,1527,1530],{"class":176,"line":1513},98,[174,1515,1516],{"class":194},"            $eligible ",[174,1518,258],{"class":200},[174,1520,915],{"class":200},[174,1522,624],{"class":194},[174,1524,43],{"class":180},[174,1526,201],{"class":200},[174,1528,1529],{"class":194},"Scope $subscriptionScope ",[174,1531,1532],{"class":200},"|\n",[174,1534,1536,1539,1541,1543,1545,1547,1549,1551,1553],{"class":176,"line":1535},99,[174,1537,1538],{"class":180},"                Where-Object",[174,1540,285],{"class":194},[174,1542,288],{"class":180},[174,1544,1192],{"class":194},[174,1546,810],{"class":200},[174,1548,1197],{"class":207},[174,1550,1200],{"class":194},[174,1552,1203],{"class":207},[174,1554,1206],{"class":194},[174,1556,1558,1561,1563],{"class":176,"line":1557},100,[174,1559,1560],{"class":194},"        } ",[174,1562,1215],{"class":200},[174,1564,758],{"class":194},[174,1566,1568,1571,1574,1576,1578,1580,1582,1584,1586,1588,1590,1592,1594],{"class":176,"line":1567},101,[174,1569,1570],{"class":180},"            Write-Warning",[174,1572,1573],{"class":207}," \"Could not read PIM eligibility for '",[174,1575,1034],{"class":200},[174,1577,624],{"class":207},[174,1579,1233],{"class":194},[174,1581,1042],{"class":207},[174,1583,1238],{"class":207},[174,1585,1034],{"class":200},[174,1587,624],{"class":207},[174,1589,288],{"class":180},[174,1591,1247],{"class":194},[174,1593,1042],{"class":207},[174,1595,1125],{"class":207},[174,1597,1599,1601,1603,1605],{"class":176,"line":1598},102,[174,1600,1516],{"class":194},[174,1602,258],{"class":200},[174,1604,915],{"class":200},[174,1606,1607],{"class":194},"()\n",[174,1609,1611],{"class":176,"line":1610},103,[174,1612,1613],{"class":194},"        }\n",[174,1615,1617],{"class":176,"line":1616},104,[174,1618,188],{"emptyLinePlaceholder":187},[174,1620,1622,1625,1628,1630],{"class":176,"line":1621},105,[174,1623,1624],{"class":200},"        foreach",[174,1626,1627],{"class":194}," ($schedule ",[174,1629,1099],{"class":200},[174,1631,1632],{"class":194}," $eligible) {\n",[174,1634,1636,1639,1641,1643,1645],{"class":176,"line":1635},106,[174,1637,1638],{"class":194},"            $results.Add([",[174,1640,1299],{"class":200},[174,1642,1302],{"class":194},[174,1644,1305],{"class":200},[174,1646,1308],{"class":194},[174,1648,1650,1653,1655],{"class":176,"line":1649},107,[174,1651,1652],{"class":194},"                SubscriptionName    ",[174,1654,258],{"class":200},[174,1656,1319],{"class":194},[174,1658,1660,1663,1665],{"class":176,"line":1659},108,[174,1661,1662],{"class":194},"                SubscriptionId      ",[174,1664,258],{"class":200},[174,1666,1330],{"class":194},[174,1668,1670,1673,1675],{"class":176,"line":1669},109,[174,1671,1672],{"class":194},"                PrincipalName       ",[174,1674,258],{"class":200},[174,1676,1677],{"class":194}," $schedule.PrincipalDisplayName\n",[174,1679,1681,1684,1686],{"class":176,"line":1680},110,[174,1682,1683],{"class":194},"                SignInName          ",[174,1685,258],{"class":200},[174,1687,1688],{"class":194}," $schedule.PrincipalEmail\n",[174,1690,1692,1695,1697],{"class":176,"line":1691},111,[174,1693,1694],{"class":194},"                PrincipalType       ",[174,1696,258],{"class":200},[174,1698,1699],{"class":194}," $schedule.PrincipalType\n",[174,1701,1703,1706,1708],{"class":176,"line":1702},112,[174,1704,1705],{"class":194},"                PrincipalObjectId   ",[174,1707,258],{"class":200},[174,1709,1710],{"class":194}," $schedule.PrincipalId\n",[174,1712,1714,1717,1719],{"class":176,"line":1713},113,[174,1715,1716],{"class":194},"                AssignmentState     ",[174,1718,258],{"class":200},[174,1720,1721],{"class":207}," \"Eligible\"\n",[174,1723,1725,1728,1730],{"class":176,"line":1724},114,[174,1726,1727],{"class":194},"                AssignmentScope     ",[174,1729,258],{"class":200},[174,1731,1732],{"class":194}," $schedule.Scope\n",[174,1734,1736,1739,1741,1743,1745,1748,1750],{"class":176,"line":1735},115,[174,1737,1738],{"class":194},"                ScopeLevel          ",[174,1740,258],{"class":200},[174,1742,755],{"class":180},[174,1744,201],{"class":200},[174,1746,1747],{"class":194},"Scope $schedule.Scope ",[174,1749,411],{"class":200},[174,1751,1416],{"class":194},[174,1753,1755,1758,1760],{"class":176,"line":1754},116,[174,1756,1757],{"class":194},"                EndDateTime         ",[174,1759,258],{"class":200},[174,1761,1762],{"class":194}," $schedule.EndDateTime\n",[174,1764,1766,1769,1771,1773,1775,1777],{"class":176,"line":1765},117,[174,1767,1768],{"class":194},"                HasCondition        ",[174,1770,258],{"class":200},[174,1772,1438],{"class":200},[174,1774,777],{"class":194},[174,1776,645],{"class":200},[174,1778,1779],{"class":194},"]::IsNullOrEmpty($schedule.Condition)\n",[174,1781,1783,1786,1788],{"class":176,"line":1782},118,[174,1784,1785],{"class":194},"                ClassicAdminConvert ",[174,1787,258],{"class":200},[174,1789,1790],{"class":180}," $false\n",[174,1792,1794],{"class":176,"line":1793},119,[174,1795,1796],{"class":194},"            })\n",[174,1798,1800],{"class":176,"line":1799},120,[174,1801,1613],{"class":194},[174,1803,1805],{"class":176,"line":1804},121,[174,1806,831],{"class":194},[174,1808,1810],{"class":176,"line":1809},122,[174,1811,188],{"emptyLinePlaceholder":187},[174,1813,1815,1818,1820,1822,1825,1827,1829,1831,1833,1836,1838],{"class":176,"line":1814},123,[174,1816,1817],{"class":194},"    $subscriptionRows ",[174,1819,258],{"class":200},[174,1821,915],{"class":200},[174,1823,1824],{"class":194},"($results ",[174,1826,279],{"class":200},[174,1828,282],{"class":180},[174,1830,285],{"class":194},[174,1832,288],{"class":180},[174,1834,1835],{"class":194},".SubscriptionId ",[174,1837,294],{"class":200},[174,1839,1840],{"class":194}," $subscription.Id })\n",[174,1842,1844,1847,1849,1851,1854,1856,1858,1860,1862,1864,1866,1869],{"class":176,"line":1843},124,[174,1845,1846],{"class":194},"    $inheritedCount ",[174,1848,258],{"class":200},[174,1850,915],{"class":200},[174,1852,1853],{"class":194},"($subscriptionRows ",[174,1855,279],{"class":200},[174,1857,282],{"class":180},[174,1859,285],{"class":194},[174,1861,288],{"class":180},[174,1863,335],{"class":194},[174,1865,294],{"class":200},[174,1867,1868],{"class":207}," \"Inherited\"",[174,1870,1871],{"class":194}," }).Count\n",[174,1873,1875,1878,1880,1882,1884,1886,1888,1890,1892,1894,1896,1898],{"class":176,"line":1874},125,[174,1876,1877],{"class":194},"    $directCount ",[174,1879,258],{"class":200},[174,1881,915],{"class":200},[174,1883,1853],{"class":194},[174,1885,279],{"class":200},[174,1887,282],{"class":180},[174,1889,285],{"class":194},[174,1891,288],{"class":180},[174,1893,335],{"class":194},[174,1895,294],{"class":200},[174,1897,340],{"class":207},[174,1899,1871],{"class":194},[174,1901,1903,1906,1908,1911,1913,1916,1918],{"class":176,"line":1902},126,[174,1904,1905],{"class":194},"    $belowCount ",[174,1907,258],{"class":200},[174,1909,1910],{"class":194}," $subscriptionRows.Count ",[174,1912,411],{"class":200},[174,1914,1915],{"class":194}," $inheritedCount ",[174,1917,411],{"class":200},[174,1919,1920],{"class":194}," $directCount\n",[174,1922,1924,1927,1929,1931,1933,1935,1937,1940,1942,1944,1947,1949,1952,1955,1958,1961,1964,1967],{"class":176,"line":1923},127,[174,1925,1926],{"class":180},"    Write-Host",[174,1928,1456],{"class":207},[174,1930,1034],{"class":200},[174,1932,624],{"class":207},[174,1934,1233],{"class":194},[174,1936,1042],{"class":207},[174,1938,1939],{"class":207}," : ",[174,1941,1034],{"class":200},[174,1943,624],{"class":207},[174,1945,1946],{"class":194},"$subscriptionRows.Count",[174,1948,1042],{"class":207},[174,1950,1951],{"class":207}," Owner row(s) (",[174,1953,1954],{"class":194},"$inheritedCount",[174,1956,1957],{"class":207}," inherited, ",[174,1959,1960],{"class":194},"$directCount",[174,1962,1963],{"class":207}," subscription, ",[174,1965,1966],{"class":194},"$belowCount",[174,1968,1969],{"class":207}," below)\"\n",[174,1971,1973],{"class":176,"line":1972},128,[174,1974,899],{"class":194},[174,1976,1978],{"class":176,"line":1977},129,[174,1979,188],{"emptyLinePlaceholder":187},[174,1981,1983,1985,1987,1990,1992,1995,1997],{"class":176,"line":1982},130,[174,1984,1056],{"class":194},[174,1986,279],{"class":200},[174,1988,1989],{"class":180}," Export-Csv",[174,1991,201],{"class":200},[174,1993,1994],{"class":194},"Path $OutputPath ",[174,1996,411],{"class":200},[174,1998,1999],{"class":194},"NoTypeInformation\n",[174,2001,2003],{"class":176,"line":2002},131,[174,2004,188],{"emptyLinePlaceholder":187},[174,2006,2008,2011,2013,2015,2017,2019,2022,2024,2027,2029],{"class":176,"line":2007},132,[174,2009,2010],{"class":194},"$uniquePrincipals ",[174,2012,258],{"class":200},[174,2014,915],{"class":200},[174,2016,1824],{"class":194},[174,2018,279],{"class":200},[174,2020,2021],{"class":180}," Select-Object",[174,2023,201],{"class":200},[174,2025,2026],{"class":194},"ExpandProperty PrincipalObjectId ",[174,2028,411],{"class":200},[174,2030,2031],{"class":194},"Unique).Count\n",[174,2033,2035,2037,2039,2041,2043,2046,2048,2051,2054,2057,2060,2063,2065,2067,2069,2071,2074,2077],{"class":176,"line":2034},133,[174,2036,1028],{"class":180},[174,2038,1456],{"class":207},[174,2040,1034],{"class":200},[174,2042,624],{"class":207},[174,2044,2045],{"class":194},"$results.Count",[174,2047,1042],{"class":207},[174,2049,2050],{"class":207}," row(s), ",[174,2052,2053],{"class":194},"$uniquePrincipals",[174,2055,2056],{"class":207}," unique principal(s) across ",[174,2058,2059],{"class":194},"$auditedCount",[174,2061,2062],{"class":207}," of ",[174,2064,1034],{"class":200},[174,2066,624],{"class":207},[174,2068,1039],{"class":194},[174,2070,1042],{"class":207},[174,2072,2073],{"class":207}," subscription(s). Report written to ",[174,2075,2076],{"class":194},"$OutputPath",[174,2078,1125],{"class":207},[21,2080,2082],{"id":2081},"notes","Notes",[26,2084,2085,2102,2112,2131,2148,2162,2177,2186,2192,2202],{},[29,2086,2087,2090,2091,2094,2095,2097,2098,2101],{},[55,2088,2089],{},"Why the scope column matters."," Called without ",[33,2092,2093],{},"-Scope",", ",[33,2096,76],{}," returns every assignment in the subscription, including ones inherited from the root and management groups and ones made on resource groups and resources below it. An earlier draft of this script labelled everything that was not on the subscription itself as \"inherited\", which lumped resource-group Owners in with management-group Owners. ",[33,2099,2100],{},"ScopeLevel"," separates them. An Owner on a single resource group is a much smaller problem than an Owner on the management group above twelve subscriptions.",[29,2103,2104,2105,36,2108,2111],{},"Inherited assignments appear once per subscription they reach, so a management-group Owner shows up on every row for every subscription under that group. That is deliberate (it is effective Owner on each), but deduplicate by ",[33,2106,2107],{},"PrincipalObjectId",[33,2109,2110],{},"AssignmentScope"," before counting how many Owner grants actually exist.",[29,2113,2114,2119,2120,2122,2123,2126,2127,2130],{},[55,2115,2116,2117,85],{},"PIM-eligible assignments are invisible to ",[33,2118,76],{}," It lists active assignments only; Microsoft's PIM integration guidance says to use ",[33,2121,43],{}," for eligible assignments and ",[33,2124,2125],{},"Get-AzRoleAssignmentSchedule"," for active time-bound ones. An eligible Owner has the same access as a permanent one once they activate, so leave ",[33,2128,2129],{},"-IncludeEligible"," on for access reviews. Eligible assignments can't be created for service principals or managed identities, because they can't perform the activation step.",[29,2132,2133,2136,2137,2139,2140,2143,2144,2147],{},[55,2134,2135],{},"Time-bound active Owners look permanent in this report."," While an active time-bound assignment is in effect, ",[33,2138,76],{}," returns it like any other active assignment, but the objects it returns (",[33,2141,2142],{},"PSRoleAssignment",") carry no start or end date, so the CSV can't tell a 30-day grant from a permanent one. If end dates matter to the review, list them with ",[33,2145,2146],{},"Get-AzRoleAssignmentSchedule -Scope \u002Fsubscriptions\u002F\u003CsubscriptionId> | Where-Object { $_.EndDateTime -ne $null }",", the query Microsoft's PIM integration guidance uses for active time-bound assignments.",[29,2149,2150,2153,2154,2157,2158,2161],{},[55,2151,2152],{},"Classic administrators are gone."," Microsoft retired the Co-Administrator and Service Administrator roles on August 31, 2024, began automatically converting remaining ones to Owner at subscription scope in December 2025, and removed the Classic Administrators blade in May 2026. There is no longer anything useful behind ",[33,2155,2156],{},"Get-AzRoleAssignment -IncludeClassicAdministrators",". The converted assignments carry the description \"The Classic Admin role was converted to an Azure Owner role on behalf of the user due to Classic Admin retirement\", which the script surfaces as ",[33,2159,2160],{},"ClassicAdminConvert = True",". Those rows deserve the first look: they are usually Owner grants nobody consciously made.",[29,2163,2164,2165,2168,2169,2172,2173,2176],{},"A group listed as an Owner is not expanded to its members; ",[33,2166,2167],{},"PrincipalType"," shows ",[33,2170,2171],{},"Group",". Resolve transitive membership in Entra ID for a named access review. For a single user, ",[33,2174,2175],{},"Get-AzRoleAssignment -SignInName \u003Cupn> -ExpandPrincipalGroups"," lists roles assigned to them and to groups they belong to.",[29,2178,2179,2182,2183,2185],{},[33,2180,2181],{},"PrincipalType = Unknown"," means ",[33,2184,76],{}," could not resolve the object in Microsoft Graph: either the principal was deleted and left an orphaned assignment behind, or the running account lacks directory read permission. Check the second case before deleting anything.",[29,2187,2188,2189,47],{},"The script sees only what the credential can read. A subscription it can't list is simply missing from the report rather than reported as an error, so check the subscription count on the first line against what you expect. One it can list but not read is skipped with a warning, and the final line then shows fewer audited than attempted (",[33,2190,2191],{},"12 of 14",[29,2193,2194,2195,2198,2199,2201],{},"Assignments made by a service provider through ",[55,2196,2197],{},"Azure Lighthouse"," are not returned by ",[33,2200,76],{}," in the customer tenant. Review those delegations separately.",[29,2203,2204,2207],{},[33,2205,2206],{},"HasCondition"," marks assignments that carry a condition. Microsoft's guidance for replacing converted classic administrators is to prefer a job-function role with fewer permissions, a narrower scope, or an Owner assignment with a condition; the column shows which Owner grants have already been constrained that way.",[21,2209,2211],{"id":2210},"source","Source",[26,2213,2214,2220,2227,2234,2240,2246,2253,2260],{},[29,2215,2216],{},[15,2217,76],{"href":2218,"rel":2219},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Faz.resources\u002Fget-azroleassignment",[68],[29,2221,2222],{},[15,2223,2226],{"href":2224,"rel":2225},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Frole-based-access-control\u002Frole-assignments-list-powershell",[68],"List Azure role assignments using Azure PowerShell",[29,2228,2229],{},[15,2230,2233],{"href":2231,"rel":2232},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Frole-based-access-control\u002Fpim-integration",[68],"Eligible and time-bound role assignments in Azure RBAC",[29,2235,2236],{},[15,2237,2125],{"href":2238,"rel":2239},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Faz.resources\u002Fget-azroleassignmentschedule",[68],[29,2241,2242],{},[15,2243,43],{"href":2244,"rel":2245},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Faz.resources\u002Fget-azroleeligibilityschedule",[68],[29,2247,2248],{},[15,2249,2252],{"href":2250,"rel":2251},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Frole-based-access-control\u002Fclassic-administrators",[68],"Azure classic subscription administrators (retirement)",[29,2254,2255],{},[15,2256,2259],{"href":2257,"rel":2258},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Frole-based-access-control\u002Fbuilt-in-roles\u002Fprivileged",[68],"Azure built-in roles: Privileged (Owner role definition)",[29,2261,2262],{},[15,2263,2265],{"href":66,"rel":2264},[68],"Elevate access to manage all Azure subscriptions and management groups",[2267,2268,2269],"style",{},"html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .s9osk, html code.shiki .s9osk{--shiki-default:#FFAB70}html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}",{"title":170,"searchDepth":184,"depth":184,"links":2271},[2272,2273,2274,2275,2276,2277],{"id":23,"depth":184,"text":24},{"id":95,"depth":184,"text":96},{"id":159,"depth":184,"text":160},{"id":428,"depth":184,"text":429},{"id":2081,"depth":184,"text":2082},{"id":2210,"depth":184,"text":2211},"techcolumnist",[2280,2281],"ps","scripts","2025-11-19T14:00:00Z","A script that walks every subscription a credential can see and reports every Owner assignment, active or PIM-eligible, by the scope it was granted at.","md",false,null,{},"\u002Fblog\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions",{"title":6,"description":2283},[2278],"blog\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions",[169,2293],"azure","\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions\u002F","JpuWCrEfxxL_nNlDHB9ys2J0xydsV96QYVUqAAiKSZU",{"title":2297,"description":2298,"date":2299,"url":2300,"categories":2301,"tags":2302,"image":2286,"readingTime":322,"canonical":2278,"sites":2304,"series":2286,"seriesOrder":2286},"PowerShell: Windows Server – Disable SMBv1 Fleet-Wide and Verify","A script that audits SMBv1 access (event 3000), disables the SMBv1 server and optional feature across Windows servers, and reports which ones still need a restart.","2025-11-26T14:00:00Z","\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck\u002F",[2280,2281],[169,2303],"windows",[2278],{"title":2306,"description":2307,"date":2308,"url":2309,"categories":2310,"tags":2311,"image":2286,"readingTime":381,"canonical":2278,"sites":2313,"series":2286,"seriesOrder":2286},"PowerShell: SCOM – Alert When a Custom Event Log Source Goes Silent","A PowerShell watchdog that writes SCOM-ready silent and recovered events when a custom application stops logging, with the unit monitor to catch them.","2025-11-12T14:00:00Z","\u002F2025\u002F11\u002F12\u002Fpowershell-scom-alert-when-a-custom-event-log-source-goes-silent\u002F",[2280,2281],[169,2312],"scom",[2278],[2315,2324,2332],{"title":2316,"description":2317,"date":2318,"url":2319,"categories":2320,"tags":2321,"image":2286,"readingTime":322,"canonical":2278,"sites":2323,"series":2286,"seriesOrder":2286},"PowerShell: Azure – Tag Every Untagged Resource in a Subscription","A PowerShell sweep that finds untagged Azure resources and adds only the missing resource group tags, plus the built-in Azure Policy that does it going forward.","2025-09-24T14:00:00Z","\u002F2025\u002F09\u002F24\u002Fpowershell-azure-tag-every-untagged-resource-in-a-subscription\u002F",[2280,2281],[169,2293,2322],"discovery",[2278],{"title":2325,"description":2326,"date":2327,"url":2328,"categories":2329,"tags":2330,"image":2286,"readingTime":381,"canonical":2278,"sites":2331,"series":2286,"seriesOrder":2286},"PowerShell: Azure – Rotate Storage Account Access Keys on a Schedule","A runbook-ready script that regenerates the older of a storage account's two access keys, using KeyCreationTime, and writes the new connection string to Key Vault.","2025-04-24T14:00:00Z","\u002F2025\u002F04\u002F24\u002Fpowershell-azure-rotate-storage-account-access-keys-on-a-schedule\u002F",[2280,2281],[169,2293],[2278],{"title":2333,"description":2334,"date":2335,"url":2336,"categories":2337,"tags":2338,"image":2286,"readingTime":381,"canonical":2278,"sites":2341,"series":2286,"seriesOrder":2286},"PowerShell: Active Directory – Report Group Membership Sprawl","Rank AD security groups by nesting depth, transitive member count, ownership and staleness for an access review, plus a per-user Kerberos token size estimate.","2025-12-03T14:00:00Z","\u002F2025\u002F12\u002F03\u002Fpowershell-active-directory-report-group-membership-sprawl\u002F",[2280,2281],[169,2339,2340],"active-directory","reporting",[2278],{"doc":2286,"posts":2343},[],1790052513224]