[TESTS] User Access Administrator

[Oppedijk]

Since having this Azure Role by just selecting a slider in the Entra ID properties, a lot of admins forget to turn it off.
This completely bypasses PIM for global admins, giving this user God mode on all Azure subscriptions.

I think we need a test for this, especially since in the setup you use this role. (and remove it if someone carefully follows the page)

[soulemike]

This is a good idea. @merill, would you want this under the MT tests or a different tests subsection?

The most consistent method I have seen of checking for that is with this from the example code to create the Entra App. Would be a good first PR, do you feel comfortable trying to add that @Oppedijk?

https://github.com/maester365/maester/blob/main/website/docs/sections/create-entra-app.md?plain=1#L71

[Oppedijk]

The query is simple, but it will not work without some earlier permissions:
Invoke-AzRest "https://management.azure.com/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&`$filter=atScope()"

If this returns objects, there are assignment.
But to run this on my machine, I need to be User Access Administrator.
I don't know how to test this with an app registration with Azure permissions

[Oppedijk]

This would work as well, but would introduce another AZ dependency:
az role assignment list --role "User Access Administrator" --scope "/"

@Snozzberries

[Oppedijk]

New-AzRoleAssignment -ObjectId $servicePrincipal -Scope "/providers/Microsoft.Authorization" -RoleDefinitionName "Reader" -ObjectType "ServicePrincipal"

Is needed for querying (this can be added next to the 2 other Azure permissions during setup)

[soulemike]

The setup uses sections, that permission can be recommended through this section.

Then a new cmdlet to check for what you laid out above in reference to Invoke-AzRest with a markdown and adding it to a Pester test, likely here.

Let me know if you need any help with a PR.