RiskyRolesAnalyzer
Commands
The audit script with its syntax, every parameter, the permissions it needs and its examples. Generated from the script's own help, so this page and Get-Help cannot disagree.
iwr https://raw.githubusercontent.com/simon-vedder/risky-roles-analyzer/main/dist/Invoke-RiskyRolesAudit.ps1 -OutFile Invoke-RiskyRolesAudit.ps1Connect-RiskyRolesAnalyzerSign in to Microsoft Graph and Azure with exactly the scopes the audit needs.Needs On the read path, the Graph delegated scopes RoleManagement.Read.Directory, Directory.Read.All, Group.Read.All and Application.Read.All, which a user consents to at sign-in, plus Azure Reader on every subscription you want to audit, or at a management group above themExport-RiskyRoleReportWrite the findings to a self-contained HTML report.Needs no permissionsGet-RiskyRoleAssignmentEvery privileged Azure RBAC and Entra ID role assignment in the tenant, scored and explained.Needs Read onlyInvoke-RiskyRolesAuditEvery privileged Azure RBAC and Entra ID role assignment in your tenant, scored, in one HTML report.Needs Azure Reader on the subscriptions you audit, or at a management group above themRemove-RiskyRoleAssignmentRemove privileged role assignments that Get-RiskyRoleAssignment found, one prompt at a time.Needs On Azure, Microsoft.Authorization/roleAssignments/delete on the scope (Owner or User Access Administrator)Restore-RiskyRoleAssignmentPut back assignments from a backup file that Remove-RiskyRoleAssignment wrote.Needs On Azure, Microsoft.Authorization/roleAssignments/write on the scopeShow-RiskyRoleAssignmentPick findings in a grid and pass the picked ones down the pipeline.Needs no permissions