Get-AzRoleAssignmentScheduleInstance needs to support -Filter on all parametersets

[JustinGrote]

Description

It is currently not possible to use Get-AzRoleAssignmentScheduleInstance to fetch an individual instance without a privilege error for an unprivileged user unless filter=asTarget() is also specified, but there is no combination of parameter sets that allow this, -Filter is only allowed with a "naked" call and the scope parameter.

Workaround

invoke-azrestmethod 'https://management.azure.com///providers/Microsoft.Authorization/roleAssignmentScheduleInstances/257498e2-xxxx-xxxx-xxxx-daaaee9025b3?$filter=asTarget%28%29&api-version=2020-10-01'`

Issue script & Debug output

N/A

Environment data

Name                           Value
----                           -----
PSVersion                      7.2.3
PSEdition                      Core
GitCommitId                    7.2.3
OS                             Microsoft Windows 10.0.22610
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.7.6                 Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script     5.6.0                 Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}

Error output

No response

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @darshanhs90, @AshishGargMicrosoft.

Issue Details

---

Description

It is currently not possible to use Get-AzRoleAssignmentScheduleInstance to fetch an individual instance without a privilege error for an unprivileged user unless filter=asTarget() is also specified, but there is no combination of parameter sets that allow this, -Filter is only allowed with a "naked" call and the scope parameter.

Workaround

invoke-azrestmethod 'https://management.azure.com///providers/Microsoft.Authorization/roleAssignmentScheduleInstances/257498e2-xxxx-xxxx-xxxx-daaaee9025b3?$filter=asTarget%28%29&api-version=2020-10-01'`

Issue script & Debug output

N/A

Environment data

Name                           Value
----                           -----
PSVersion                      7.2.3
PSEdition                      Core
GitCommitId                    7.2.3
OS                             Microsoft Windows 10.0.22610
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.7.6                 Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script     5.6.0                 Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}

Error output

No response

Author:	JustinGrote
Assignees:	-
Labels:	feature-request, Authorization, Service Attention, customer-reported
Milestone:	-

[dingmeng-xue]

@JustinGrote , thanks for reporting. Azure PowerShell cmdlet bases on API spec. You can see filter is not defined by RoleEligibilityScheduleInstances_Get

https://github.com/Azure/azure-rest-api-specs/blob/0023223a23b7a8c1693f7d88678787e50fee6c96/specification/authorization/resource-manager/Microsoft.Authorization/preview/2020-10-01-preview/RoleEligibilityScheduleInstance.json#L89

I involve service team into this Github issue.