Repository navigation
Get-AzRoleDefinition -Name "[...]" should be able to return the complete Actions list, not solely "*" #8977
Description
When performing the following, users who may be Azure Administrators attempting to have fine-grained permissions/control of their users' experiences, should have full visibility of the full list of Actions, rather than simply receiving an asterisk ("*") for the list of role Actions, when performing:
Get-AzRoleDefinition -Name "Contributor" -Verbose true
Instead of returning "*" for Actions -
{
"Name": "Contributor",
"Id": "b24988ac-6180-42a0-ab88-20f7382dd24c",
[...]
"Actions": ["*"],
[...]
}
The Cmdlet should return the itemized list of Actions, when "-Verbose true" is added to the request, which could be [converted to Json and] piped to a file:
{
"Name": "Contributor",
"Id": "b24988ac-6180-42a0-ab88-20f7382dd24c",
[...]
"Actions": [
"THE ENTIRE ITEMIZED LIST",
"OF APPLICABLE ACTIONS",
" SHOULD BE LISTED HERE",
"RATHER THAN '*'"
],
[...]
}
Assumption: Large action lists, such as those that are part of the "Contributor" role, are the only ones that may abstract long Action lists into "*".
Activity
[-]Get-AzRoleDefinition -Name "Contributor" should be able to return the complete Actions list, not solely "*"[/-][+]Get-AzRoleDefinition -Name "[...]" should be able to return the complete Actions list, not solely "*"[/+]navba-MSFT commentedon Mar 10, 2022
hlarrymoprem Apologies for the late reply. We will update this thread once we have more details on this.
Haridarshan HS (@darshanhs90), AshishGargMicrosoft Could you please let us know if there are any plans to implement this feature request ?
microsoft-github-policy-service commentedon Apr 10, 2026
🔔 Routing this issue to @act-identity-squad.
teresaritorto commentedon Oct 8, 2026
For built-in roles like Contributor, [""] is the actual content of the role definition in Azure, not a truncated or abstracted list. The "" is a wildcard meaning all control plane actions, so
Get-AzRoleDefinitionis returning the role definition exactly as it is stored, and there is no itemized list hidden behind the asterisk.To enumerate the concrete operations the wildcard covers, use Get-AzProviderOperation * (or scope it to a provider, for example Get-AzProviderOperation Microsoft.Compute/*).
Closing as working as intended.
If there is a specific scenario that neither cmdlet can express, please open a fresh issue with the exact command and the expected output.