Allow removal of role assignment condition#29517
Open
rsegers wants to merge 2 commits intoAzure:mainfrom
Open
Conversation
| Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status. |
Author
|
@microsoft-github-policy-service agree |
Contributor
|
Thank you for your contribution @rsegers! We will review the pull request and get back to you soon. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Az.Resources Set-AzRoleAssignment cmdlet implementation to support removing an existing role assignment condition by allowing both Condition and ConditionVersion to be cleared, matching documented Azure RBAC behavior.
Changes:
- Allowed clearing both
ConditionandConditionVersionwithout triggering the “cannot downgrade” condition-version validation. - Added an Az.Resources changelog entry describing the user-facing behavior change.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/Resources/Resources/RoleAssignments/SetAzureRoleAssignmentCommand.cs | Adjusted condition-version downgrade validation to permit condition removal (both condition fields cleared). |
| src/Resources/Resources/ChangeLog.md | Documented the behavior change for Set-AzRoleAssignment under “Upcoming Release”. |
Comment on lines
122
to
130
| var oldConditionVersion = string.IsNullOrWhiteSpace(fetchedRole.ConditionVersion)? Version.Parse("0.0") : Version.Parse(fetchedRole.ConditionVersion); | ||
| var newConditionVersion = string.IsNullOrWhiteSpace(InputObject.ConditionVersion) ? Version.Parse("0.0") : Version.Parse(InputObject.ConditionVersion); | ||
| var emptyCondition = string.IsNullOrWhiteSpace(InputObject.ConditionVersion) && string.IsNullOrWhiteSpace(InputObject.Condition); | ||
|
|
||
| // A condition version can change but currently we don't support downgrading to 1.0 | ||
| // we only verify the change if it's a downgrade | ||
| if ((oldConditionVersion > newConditionVersion) && (newConditionVersion.Major < 2)) | ||
| // we only verify the change if it's a downgrade. Removal of condition is allowed | ||
| if ((oldConditionVersion > newConditionVersion) && (newConditionVersion.Major < 2) && !emptyCondition) | ||
| { | ||
| throw new ArgumentException("Condition version different than '2.0' is not supported for update operations"); |
Comment on lines
21
to
+22
| ## Upcoming Release | ||
| * Allow `Set-AzRoleAssignment` to delete conditions from a role assignment |
Contributor
There was a problem hiding this comment.
@rsegers, please update the line based on Copilot's comment.
Contributor
|
/azp run |
Contributor
|
Azure Pipelines successfully started running 3 pipeline(s). |
YanaXu
requested changes
May 7, 2026
Comment on lines
21
to
+22
| ## Upcoming Release | ||
| * Allow `Set-AzRoleAssignment` to delete conditions from a role assignment |
Contributor
There was a problem hiding this comment.
@rsegers, please update the line based on Copilot's comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Currently it is not possible to remove a condition on a role assignment.
Consider an existing role assignment with an condition with the intention to remove the condition:
This yields the following error:
Set-AzRoleAssignment: Condition version different than '2.0' is not supported for update operationsRemoving the condition is possible when setting both
ConditionandConditionVersionto$nullor an empty stringMandatory Checklist
Please choose the target release of Azure PowerShell. (⚠️ Target release is a different concept from API readiness. Please click below links for details.)
Check this box to confirm: I have read the Submitting Changes section of
CONTRIBUTING.mdand reviewed the following information:ChangeLog.mdfile(s) appropriatelysrc/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.## Upcoming Releaseheader in the past tense.ChangeLog.mdif no new release is required, such as fixing test case only.