How to assign Reader role to user in Azure Subscription using Python SDK?

Question

I’m trying to assign "Reader" role to user under Azure subscription using Azure Python SDK. I’ve found a way to do it using Azure REST API following MS documentation https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-rest , but I’m not sure how to do the same thing with the SDK.

Here’s the code I’m using with Python’s requests library to call REST API directly:

import requests
import uuid

scope = "subscriptions/{subscription_id}/resourceGroups/{resource_group_name}"
role_assignment_id = str(uuid.uuid4())
role_definition_id = "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7"  # Reader role ID
principal_id = "{user_principal_id}"

url = f"https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{role_assignment_id}?api-version=2022-04-01"

access_token = "{access_token}"

headers = {
    "Authorization": f"Bearer {access_token}",
    "Content-Type": "application/json"
}

body = {
    "properties": {
        "roleDefinitionId": role_definition_id,
        "principalId": principal_id
    }
}

response = requests.put(url, headers=headers, json=body)

if response.status_code == 201:
    print("Role assigned successfully.")
else:
    print(f"Failed to assign role. Status Code: {response.status_code}, Response: {response.text}")

The code above works fine, but I want to switch to using Azure Python SDK instead of directly calling the REST API. I’ve searched through the SDK documentation, but I can’t find any example or method that shows how to assign roles like this.

Could you confirm whether your requirement is to assign Reader role to user using Azure Python SDK under subscription scope? — Sridevi
– Sridevi, Commented Dec 11, 2024 at 11:20
Could you confirm whether you want to authenticate using service principal or signed-in user? — Sridevi
– Sridevi, Commented Dec 11, 2024 at 11:51
obtained bearer token with app owner access, but the user sign-ins aren't applicable to our situation. Is that what you refer to as authentication? — James Wilton
– James Wilton, Commented Dec 11, 2024 at 12:13

Sridevi · Accepted Answer · 2024-12-11 13:02:37Z

I have one app registration having Owner access under subscription like this:

To assign "Reader" role to user under Azure subscription using Azure Python SDK with service principal authentication, make use of below sample code:

from azure.identity import ClientSecretCredential
from azure.mgmt.authorization import AuthorizationManagementClient
import uuid

tenant_id = "tenantId"
client_id = "appId"
client_secret = "secret"

subscription_id = "subId"
scope = "subscriptions/subId"
role_definition_id = "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7"
principal_id = "userId"

role_assignment_id = str(uuid.uuid4())

credential = ClientSecretCredential(
    tenant_id=tenant_id,
    client_id=client_id,
    client_secret=client_secret
)

authorization_client = AuthorizationManagementClient(credential, subscription_id)

try:
    role_assignment = authorization_client.role_assignments.create(
        scope=scope,
        role_assignment_name=role_assignment_id,
        parameters={
            "properties": {
                "roleDefinitionId": role_definition_id,
                "principalId": principal_id
            }
        }
    )
    print("Role assigned successfully:", role_assignment)
except Exception as e:
    print("Failed to assign role:", str(e))

Response:

To confirm that, I checked the same in Portal where Reader role assigned successfully to user under subscription as below:

Hetman70 · Accepted Answer · 2024-12-11 11:21:45Z

0

Try this:

from azure.identity import DefaultAzureCredential

from azure.mgmt.authorization import AuthorizationManagementClient

import uuid

subscription_id = "{subscription_id}"

resource_group_name = "{resource_group_name}"

principal_id = "{user_principal_id}"  # User's object ID in Azure AD

role_definition_id = "/subscriptions/{subscription_id}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7"  

scope = f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}"

role_assignment_id = str(uuid.uuid4())

credential = DefaultAzureCredential()

auth_client = AuthorizationManagementClient(credential, subscription_id)

try:
    role_assignment = auth_client.role_assignments.create(
        scope=scope,
        role_assignment_name=role_assignment_id,
        parameters={
            "properties": {
                "roleDefinitionId": role_definition_id,
                "principalId": principal_id
            }
        }
    )
    print("Role assigned successfully:", role_assignment)
except Exception as e:
    print("Failed to assign role:", str(e))

answered Dec 11, 2024 at 11:21

Hetman70

1

2 Comments

James Wilton Dec 11, 2024 at 11:45

DefaultAzureCredential failed to retrieve a token from the included credentials. Attempted credentials:EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.Visit aka.ms/azsdk/python/identity/environmentcredential/troubleshoot to troubleshoot this issue. ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable.SharedTokenCacheCredential: SharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.AzureCliCredential: Please run 'az login' to set up an account

Jeremy Caney Dec 16, 2024 at 1:30

Thank you for contributing to the Stack Overflow community. This may be a correct answer, but it’d be really useful to provide additional explanation of your code so developers can understand your reasoning. This is especially useful for new developers who aren’t as familiar with the syntax or struggling to understand the concepts. Would you kindly edit your answer to include additional details for the benefit of the community?

Hetman70 · Accepted Answer · 2024-12-13 06:30:42Z

0

Set the following environment variables with appropriate values for your Azure service principal:

set AZURE_CLIENT_ID=your-client-id
set AZURE_TENANT_ID=your-tenant-id
set AZURE_CLIENT_SECRET=your-client-secret

After setting these variables, DefaultAzureCredential will use them to authenticate.

answered Dec 13, 2024 at 6:30

Hetman70

1

1 Comment

James Wilton Dec 13, 2024 at 7:14

No worries, code from Sridevi is working well at the moment!

Collectives™ on Stack Overflow

How to assign Reader role to user in Azure Subscription using Python SDK?

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related