Share via

Subscription RBAC export does not include roles assigned to PIM onboarded security groups

Robert Thomson 0 Reputation points
2025-08-21T20:48:48.3733333+00:00

Using azure portal 'download rbac assignments' for the subscription, and similarly using 'az' and 'management.azure.com' api's they all do not include roles assigned to the PIM onboarded security groups - every other role assignment is present, including those assigned to non pim onboarded security groups.

What method is needed to export these group based role assignments?

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Surya Prakash Kotte 160 Reputation points Microsoft External Staff Moderator
    2025-08-21T21:50:01.9933333+00:00

    Hello Robert Thomson,

    As per your request, you are looking to export role assignments for PIM-enabled security groups.

    Please note that downloading role assignments from Subscription > Access Control (IAM) will not include these groups, as PIM security groups are managed in Microsoft Entra ID and are not treated as resources within the subscription.

    To retrieve this information, you can use the Microsoft Graph API to get a list of active and eligible role assignments for PIM groups. However, the response will include the role assignments, but not the group names directly.

    Once you identify the group name separately, you can then retrieve and export the list of users within that group.

    Please refer to the documentation below for more details.

    https://learn.microsoft.com/en-us/graph/api/privilegedaccessgroup-list-eligibilityscheduleinstances?view=graph-rest-1.0&tabs=http

    https://learn.microsoft.com/en-us/graph/api/privilegedaccessgroup-list-assignmentscheduleinstances?view=graph-rest-1.0&tabs=http

    If you have any questions, feel free to reach out — I’m happy to assist you.

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.