How to get the condition value for creating an eligible role assignment with excluding roles?

Question

I’m automating Azure eligible role assignments using REST API calls and currently have a setup where Owner eligible role assignment restricts users to assign roles like Reader and Storage Blob Data Contributor only.

PUT https://management.azure.com/providers/Microsoft.Subscription/subscriptions/subId/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/random_guid?api-version=2020-10-01-preview

{
  "properties": {
    "principalId": "userId",
    "roleDefinitionId":
"/subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
    "requestType": "AdminAssign",
    "scheduleInfo": {
      "startDateTime": "2024-07-31T00:00:00Z",
      "expiration": {
        "type": "AfterDuration",
        "endDateTime": null,
        "duration": "P365D"
      }
    },
    "condition":
"((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'}))
OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId]
ForAnyOfAnyValues:GuidEquals {acdd72a7-3385-48ef-bd42-f606fba81ae7,
ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'}))
OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId]
ForAnyOfAnyValues:GuidEquals {acdd72a7-3385-48ef-bd42-f606fba81ae7,
ba92f5b4-2d11-453d-a403-e96b0029c9fe}))",
    "conditionVersion": "2.0"
  }
}

I need to adjust this condition so that users can assign any role except Owner and User Access Administrator roles to avoid role assignments to others. Tried changing its value to exclude role definition ids by negating them, but throwing errors:

{"error": {  "code": "InvalidCreateOrUpdateRoleAssignmentRequest",  "message": "The given role assignment condition is invalid."  } }

Answer 1

In Portal, you can find below option that allows users to assign all roles except specific roles:

You can click on Configure button and select roles that you want to exclude like this:

In the next screen, you can find condition value for creating an eligible role assignment with excluding roles like this:

You can use this condition value to create eligible role assignments excluding roles with below sample API request:

PUT https://management.azure.com/providers/Microsoft.Subscription/subscriptions/subId/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/random_guid?api-version=2020-10-01-preview

{
  "properties": {
    "principalId": "userId",
    "roleDefinitionId": "/subscriptions/subId/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
    "requestType": "AdminAssign",
    "scheduleInfo": {
      "startDateTime": "2024-07-28T19:29:00.91Z",
      "expiration": {
        "type": "AfterDuration",
        "endDateTime": null,
        "duration": "P365D"
      }
    },
    "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAllValues:GuidNotEquals {8e3af657-a8ff-443c-a75c-2fe8c4bcb635, 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAllValues:GuidNotEquals {8e3af657-a8ff-443c-a75c-2fe8c4bcb635, 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9}))",
    "conditionVersion": "2.0"
  }
}

Response:

To confirm that, I checked the same in Portal where eligible role assignment created successfully with condition as below: