azure - 获取-AzDenyAssignment : 'directoryObjectId' cannot be null

Question

我正在尝试按照 docs 列出我的 Azure 订阅中的拒绝语句，但是，我收到此错误:

PS /Users/me> Get-AzDenyAssignment
WARNING: We have migrated the API calls for this cmdlet from Azure Active Directory Graph to Microsoft Graph.
Visit https://go.microsoft.com/fwlink/?linkid=2181475 for any permission issues.
Get-AzDenyAssignment: 'directoryObjectId' cannot be null.

输出中列出的页面没有有关directoryObjectId 的任何信息。

我还尝试过其他组合，例如

PS /Users/me> Get-AzDenyAssignment -ResourceGroupName my-resource-group
WARNING: We have migrated the API calls for this cmdlet from Azure Active Directory Graph to Microsoft Graph.
Visit https://go.microsoft.com/fwlink/?linkid=2181475 for any permission issues.
Get-AzDenyAssignment: 'directoryObjectId' cannot be null.

有什么想法吗？

<小时/>

我的环境:

PS /Users/chris.snow> Get-Module

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.9.0                 Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzCont…
Script     6.0.1                 Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, …
Script     1.10.0                Microsoft.Graph.Authentication      {Add-MgEnvironment, Connect-MgGraph, Disconnect-…
Script     1.10.0                Microsoft.Graph.DirectoryObjects    {Confirm-MgDirectoryObjectMemberGroup, Confirm-M…
Manifest   7.0.0.0               Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-I…
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-O…
Script     1.4.7                 PackageManagement                   {Find-Package, Find-PackageProvider, Get-Package…
Script     2.2.5                 PowerShellGet                       {Find-Command, Find-DscResource, Find-Module, Fi…
Script     2.1.0                 PSReadLine                          {Get-PSReadLineKeyHandler, Get-PSReadLineOption,…

Answer 1

• 我们可以在Azure Portal或Azure CLI中查看azure订阅的拒绝语句列表 em> 或使用REST API

• 在检查列表之前，请确保您拥有 MSDoc 中提到的所需权限。

检查 Azure 门户中的角色

打开Azure 门户 => 订阅 => 选择您的订阅 =>访问控制 (IAM) => 检查访问 => 查看我的访问权限

从 Azure 门户查看

导航至Azure 门户 => 订阅 => 选择您的订阅 =>访问控制 (IAM) => 点击查看拒绝分配选项卡

使用 Azure CLI

Get-AzDenyAssignment

使用 REST API

GET https://management.azure.com/{scope}/providers/Microsoft.Authorization/denyAssignments/{deny-assignment-id}?api-version=2018-07-01-preview

• 范围 - 我已给出Subscriptions/“MySubscriptionID”