Add az role deny-assignment create/delete commands (user-assigned deny assignments) by jruttle · Pull Request #33109 · Azure/azure-cli

jruttle · 2026-03-31T13:10:47Z

Description

Adds az role deny-assignment create and az role deny-assignment delete commands for managing user-assigned deny assignments, matching the existing az role assignment pattern.

This implements the PUT/DELETE operations added in the Microsoft.Authorization/denyAssignments API (2024-07-01-preview), as specified in swagger PR #41104.

PP1 (Preview) Constraints

User-assigned deny assignments have specific restrictions enforced by the service:

Principals must be Everyone (SystemDefined with 00000000-0000-0000-0000-000000000000)
ExcludePrincipals is required (at least one principal must be excluded)
No DataActions — only Actions/NotActions are supported
No Read actions — actions like */read are not permitted
No DoNotApplyToChildScopes — this property is not supported

Commands Added

az role deny-assignment list — List deny assignments (existing, enhanced)
az role deny-assignment show — Show a deny assignment (existing, enhanced)
az role deny-assignment create — Create a user-assigned deny assignment
az role deny-assignment delete — Delete a user-assigned deny assignment

Files Changed

commands.py — Command registration for role deny-assignment group
custom.py — Business logic (4 functions with PP1 validation)
_params.py — Parameter definitions for all deny-assignment commands
_help.py — Help text with examples for all 4 commands + group
linter_exclusions.yml — Exclusions for long parameter names
tests/latest/test_deny_assignment.py — Unit tests (list, show, CRUD)

Dependency

Note: The create and delete operations depend on the Python SDK PR azure-sdk-for-python#46012 being merged first. The current azure-mgmt-authorization 5.0.0b1 package does not include the create or delete methods. Once the SDK PR merges and a new package version is released, this PR's SDK reference should be updated accordingly.

Testing

Tests are included in test_deny_assignment.py. Full end-to-end testing requires:

A subscription with the Microsoft.Authorization/SubscriptionAllowedToOperateUserAssignedDenyAssignment feature flag registered
The updated Python SDK with create/delete support

Pull request overview

Adds first-class az role deny-assignment CRUD support (focused on PP1 user-assigned deny assignments) to align with existing role assignment workflows, including command registration, parameters, help, and tests.

Changes:

Register az role deny-assignment list/show/create/delete commands and add a table transformer for list output.
Implement deny-assignment list/show/create/delete custom handlers with PP1 validation.
Add help/params, linter exclusions for long options, and introduce a new deny-assignment test file.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`src/azure-cli/azure/cli/command_modules/role/custom.py`	Adds deny-assignment list/show/create/delete implementations and PP1 input validation.
`src/azure-cli/azure/cli/command_modules/role/commands.py`	Registers new `role deny-assignment` commands and list table transformer.
`src/azure-cli/azure/cli/command_modules/role/_params.py`	Defines CLI parameters for deny-assignment commands.
`src/azure-cli/azure/cli/command_modules/role/_help.py`	Adds help text and examples for the new/updated deny-assignment commands.
`src/azure-cli/azure/cli/command_modules/role/linter_exclusions.yml`	Excludes option-length lint rules for new long parameter names.
`src/azure-cli/azure/cli/command_modules/role/tests/latest/test_deny_assignment.py`	Adds scenario/live tests covering list/show and PP1 create/delete validation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-31T13:19:28Z

src/azure-cli/azure/cli/command_modules/role/custom.py

+        'deny_assignment_name': deny_assignment_name,
+        'description': description or '',
+        'permissions': [{
+            'actions': actions or [],
+            'not_actions': not_actions or [],
+            'data_actions': [],
+            'not_data_actions': []
+        }],
+        'scope': scope,
+        'principals': principals,
+        'exclude_principals': exclude_principals,
+        'is_system_protected': False


create_deny_assignment builds the request body as a plain dict using snake_case keys (e.g. deny_assignment_name, not_actions, exclude_principals). For mgmt SDK operations, dicts are typically serialized as-is, so the service will receive incorrect field names (it expects camelCase JSON, or a proper SDK model instance). Use the azure-mgmt-authorization model types via get_sdk(..., mod='models') (similar to RoleApiHelper.create_role_assignment) or ensure the payload keys match the service JSON contract exactly.

Suggested change

'deny_assignment_name': deny_assignment_name,

'description': description or '',

'permissions': [{

'actions': actions or [],

'not_actions': not_actions or [],

'data_actions': [],

'not_data_actions': []

}],

'scope': scope,

'principals': principals,

'exclude_principals': exclude_principals,

'is_system_protected': False

'denyAssignmentName': deny_assignment_name,

'description': description or '',

'permissions': [{

'actions': actions or [],

'notActions': not_actions or [],

'dataActions': [],

'notDataActions': []

}],

'scope': scope,

'principals': principals,

'excludePrincipals': exclude_principals,

'isSystemProtected': False

Copilot · 2026-03-31T13:19:28Z

src/azure-cli/azure/cli/command_modules/role/custom.py

+    return deny_client.create(scope=scope, deny_assignment_id=assignment_name,
+                              parameters=deny_assignment_params)


This calls authorization_client.deny_assignments.create(...), but the repo currently pins azure-mgmt-authorization==5.0.0b1 (which does not include denyAssignments create/delete per the PR description). Without bumping the SDK dependency (or adding a fallback implementation / friendly error), this command will raise AttributeError at runtime.

Copilot · 2026-03-31T13:19:28Z

src/azure-cli/azure/cli/command_modules/role/custom.py

+def delete_deny_assignment(cmd, scope=None, deny_assignment_id=None, deny_assignment_name=None):
+    """Delete a user-assigned deny assignment."""
+    authorization_client = _auth_client_factory(cmd.cli_ctx, scope)
+    deny_client = authorization_client.deny_assignments
+
+    if deny_assignment_id:
+        return deny_client.delete_by_id(deny_assignment_id)
+    if deny_assignment_name and scope:
+        return deny_client.delete(scope=scope, deny_assignment_id=deny_assignment_name)
+    raise CLIError('Please provide --id, or both --name and --scope.')


Same dependency issue as create: deny_client.delete(...)/delete_by_id(...) will fail at runtime unless the pinned azure-mgmt-authorization version includes these methods. Consider either updating the dependency in this PR or detecting missing methods and raising a clear CLIError instructing users to upgrade.

Copilot · 2026-03-31T13:19:29Z

src/azure-cli/azure/cli/command_modules/role/_params.py

+        c.argument('deny_assignment_name', options_list=['--name', '-n'],
+                   help='The display name of the deny assignment.')


deny_assignment_name is defined at the role deny-assignment group level, which makes --name/-n show up for subcommands like list even though list_deny_assignments doesn't accept that parameter. If a user supplies --name on list, the handler will receive an unexpected kwarg and fail. Recommend removing deny_assignment_name from the group context and defining --name only on show/create/delete where it is supported.

Suggested change

c.argument('deny_assignment_name', options_list=['--name', '-n'],

help='The display name of the deny assignment.')

Copilot · 2026-03-31T13:19:29Z

src/azure-cli/azure/cli/command_modules/role/_params.py

+        c.argument('exclude_principal_ids', nargs='+', options_list=['--exclude-principal-ids'],
+                   help='Space-separated list of principal object IDs to exclude from the deny. '
+                        'At least one is required for user-assigned deny assignments.')
+        c.argument('exclude_principal_types', nargs='+', options_list=['--exclude-principal-types'],


--exclude-principal-types is documented as having accepted values, but the argument doesn't enforce them. To keep validation consistent with role assignment create --assignee-principal-type, use arg_type=get_enum_type([...]) (or an Enum) so invalid values are caught client-side with a clear error.

Suggested change

c.argument('exclude_principal_types', nargs='+', options_list=['--exclude-principal-types'],

c.argument('exclude_principal_types', nargs='+', options_list=['--exclude-principal-types'],

arg_type=get_enum_type(['User', 'Group', 'ServicePrincipal']),

Copilot · 2026-03-31T13:19:29Z

src/azure-cli/azure/cli/command_modules/role/tests/latest/test_deny_assignment.py

+class DenyAssignmentListTest(ScenarioTest):
+    """Tests for az role deny-assignment list — works on any subscription."""
+
+    def test_deny_assignment_list(self):
+        """List deny assignments at the subscription scope."""
+        result = self.cmd('role deny-assignment list').get_output_in_json()
+        # Result should be a list (may be empty if no deny assignments exist)
+        self.assertIsInstance(result, list)
+
+    def test_deny_assignment_list_with_scope(self):
+        """List deny assignments at a specific scope."""
+        self.cmd('role deny-assignment list --scope /subscriptions/{sub}',
+                 checks=[self.check('type(@)', 'array')])
+
+    def test_deny_assignment_list_with_filter(self):
+        """List deny assignments with OData filter."""
+        result = self.cmd(
+            'role deny-assignment list --filter "atScope()"'
+        ).get_output_in_json()
+        self.assertIsInstance(result, list)
+


This file adds ScenarioTest cases for role deny-assignment list that will require a new VCR recording to pass in playback mode, but no corresponding recording YAML is added under tests/latest/recordings. Either add recordings for these scenario tests or convert them to mock-based tests (or LiveScenarioTest if they must be live-only) so CI doesn't fail.

Copilot · 2026-03-31T13:19:30Z

src/azure-cli/azure/cli/command_modules/role/tests/latest/test_deny_assignment.py

+        self.kwargs.update({
+            'scope': '/subscriptions/{sub}',
+            'name': 'CLI Test Deny Assignment',
+            'action': 'Microsoft.Authorization/roleAssignments/write',
+            # Use a well-known object ID for exclusion (replace with a real SP in your test env)
+            'exclude_id': self.create_guid()


exclude_id is set to self.create_guid(), which is a random GUID and is unlikely to correspond to a real principal in the tenant. If the denyAssignment API validates excluded principals, this live test will fail reliably. Prefer creating a real principal in the test setup (or using the signed-in user/service principal object id) and passing its object ID here.

Suggested change

self.kwargs.update({

'scope': '/subscriptions/{sub}',

'name': 'CLI Test Deny Assignment',

'action': 'Microsoft.Authorization/roleAssignments/write',

# Use a well-known object ID for exclusion (replace with a real SP in your test env)

'exclude_id': self.create_guid()

signed_in_user = self.cmd('ad signed-in-user show').get_output_in_json()

exclude_id = signed_in_user['id']

self.kwargs.update({

'scope': '/subscriptions/{sub}',

'name': 'CLI Test Deny Assignment',

'action': 'Microsoft.Authorization/roleAssignments/write',

'exclude_id': exclude_id

Copilot · 2026-03-31T13:19:30Z

src/azure-cli/azure/cli/command_modules/role/tests/latest/test_deny_assignment.py

+# These tests require a subscription with the UserAssignedDenyAssignment feature flag enabled.
+
+import unittest
+from unittest import mock


Unused import: from unittest import mock is not used in this test file. Please remove it to keep linting clean.

Suggested change

from unittest import mock

Add deny assignment create/delete CLI commands

0a4e720

jruttle requested review from isra-fel and notyashhh as code owners March 31, 2026 13:10

Copilot AI review requested due to automatic review settings March 31, 2026 13:10

jruttle requested review from teresaritorto and xuming-ms as code owners March 31, 2026 13:10

azure-client-tools-bot-prd bot added this to the May 2026 (2026-05-05) milestone Mar 31, 2026

microsoft-github-policy-service bot requested review from jiasli and yonzhan March 31, 2026 13:11

microsoft-github-policy-service bot added the Auto-Assign Auto assign by bot label Mar 31, 2026

microsoft-github-policy-service bot assigned jiasli Mar 31, 2026

microsoft-github-policy-service bot added RBAC az role act-identity-squad labels Mar 31, 2026

Copilot started reviewing on behalf of jruttle March 31, 2026 13:12 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Jonathan Ruttle added 2 commits March 31, 2026 20:14

Fix flake8 E127 indentation in _params.py

1835bd3

Fix unused import and add input validation

6c9f302

This was referenced Apr 1, 2026

[TSP Migration][authorization-12-01]TypeSpec migrated from swagger Azure/azure-rest-api-specs#41617

Draft

Add DenyAssignment TypeSpec with 2024-07-01-preview CreateOrUpdate/Delete operations Azure/azure-rest-api-specs#42007

Open

		return deny_client.create(scope=scope, deny_assignment_id=assignment_name,
		parameters=deny_assignment_params)

		c.argument('deny_assignment_name', options_list=['--name', '-n'],
		help='The display name of the deny assignment.')

	c.argument('exclude_principal_types', nargs='+', options_list=['--exclude-principal-types'],
	c.argument('exclude_principal_types', nargs='+', options_list=['--exclude-principal-types'],
	arg_type=get_enum_type(['User', 'Group', 'ServicePrincipal']),

Conversation

jruttle commented Mar 31, 2026

Description

PP1 (Preview) Constraints

Commands Added

Files Changed

Dependency

Testing

Related

Uh oh!

azure-client-tools-bot-prd bot commented Mar 31, 2026

Uh oh!

azure-client-tools-bot-prd bot commented Mar 31, 2026

Uh oh!

yonzhan commented Mar 31, 2026

Uh oh!

github-actions bot commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants