Exporting Subscriptions and Role Assignments Issue

For exporting subscription-level role assignments with full principal details, there are two supported approaches in the provided material: using the Azure portal for Azure RBAC roles and using Microsoft Entra ID for directory roles. Both avoid the continuous access evaluation issue seen in custom scripts.

1. Export Azure RBAC role assignments per subscription in the Azure portal

This gives all role assignments (built‑in and custom) at a chosen scope, including users, groups, and service principals.

Steps:

1. In the Azure portal, go to All services and select the scope:
   • Subscriptions → choose the subscription whose assignments are needed.
2. Open the subscription and select Access control (IAM).
3. Select Download role assignments to open the download pane.
4. Choose which assignments to include:
   • Inherited – include assignments inherited from higher scopes.
   • At current scope – include assignments defined directly on the subscription.
   • Children – include assignments on child resource groups and resources.
5. Select file format CSV (best for analysis) or JSON.
6. Provide a file name and select Start.

The CSV/JSON output contains, for each assignment:

• Role definition
• Scope
• Principal information (user, group, or service principal)
• Additional metadata

If directory read permissions are missing (for example, no Directory Readers role), the DisplayName, SignInName, and ObjectType columns will be blank; in that case, grant appropriate directory read permissions and re-export.

Repeat this for each subscription in the tenant to build a complete inventory of subscription-level Azure RBAC assignments.

2. Export Microsoft Entra role assignments (directory roles)

If the requirement also includes Microsoft Entra directory roles (Global Administrator, etc.), these can be exported centrally.

To export all active directory role assignments across all roles:

1. In the Microsoft Entra admin center, go to Entra ID → Roles & admins.
2. On Roles and administrators, select All roles.
3. Select Download assignments.
4. Specify a file name and select Start bulk operation.

A CSV file is downloaded listing all role assignments at all scopes for all directory roles, including the assigned user, group, or service principal.

To export assignments for a single directory role:

1. On Roles and administrators, select the specific role.
2. Select Download assignments (or Export if using PIM experience).
3. A CSV file is downloaded listing all assignments for that role at all scopes.
4. Export user and group assignments to service principals (enterprise apps)

For a tenant-wide view of which users and groups are assigned to enterprise applications (service principals), Microsoft Entra PowerShell can export this to CSV:

1. Connect with sufficient permissions (for example, Cloud Application Administrator):

      Connect-Entra -Scopes 'Directory.Read.All', 'Application.Read.All'
   

2. Run the documented script that:
   • Retrieves all service principals.
   • Collects user and group assignments for each service principal.
   • Exports to CSV with service principal name, assigned users, and assigned groups.

This complements the Azure RBAC export by giving application assignment details for all service principals in the tenant.

Using these built-in export capabilities avoids the continuous access evaluation challenges that can interrupt long-running custom scripts and provides the requested mapping of subscriptions to role assignments and principals (users, groups, and service principals).

References:

• List Azure role assignments using the Azure portal
• List Microsoft Entra role assignments
• Manage user and group assignments