Skip to content

Commit f319f87

Browse files
jaredfholgatejaredfholgate
committed
add switch
1 parent 174d56e commit f319f87

1 file changed

Lines changed: 45 additions & 26 deletions

File tree

‎src/ALZ/Public/Remove-PlatformLandingZone.ps1‎

Lines changed: 45 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,12 @@ function Remove-PlatformLandingZone {
9393
subscriptions. This is useful when you want to preserve deployment records for audit or compliance purposes.
9494
Default: $false (delete deployments)
9595
96+
.PARAMETER skipOrphanedRoleAssignmentDeletion
97+
A switch parameter that skips orphaned role assignment deletion operations at both the management group and
98+
subscription levels. When specified, the function will not delete role assignments where the principal no
99+
longer exists. This is useful when you want to preserve role assignment records or lack the necessary permissions.
100+
Default: $false (delete orphaned role assignments)
101+
96102
.EXAMPLE
97103
Remove-PlatformLandingZone -managementGroups @("alz-platform", "alz-landingzones")
98104
@@ -155,6 +161,12 @@ function Remove-PlatformLandingZone {
155161
Removes management groups and resource groups but skips resetting Microsoft Defender plans and deleting
156162
deployment history. Useful for faster cleanup when Defender configuration and audit trails should be preserved.
157163
164+
.EXAMPLE
165+
Remove-PlatformLandingZone -subscriptions @("Sub-Test-001") -skipOrphanedRoleAssignmentDeletion
166+
167+
Cleans up the subscription but skips orphaned role assignment deletion. Useful when you want to preserve
168+
role assignments for review or lack the necessary permissions to delete them.
169+
158170
.NOTES
159171
This function uses Azure CLI commands and requires:
160172
- Azure CLI to be installed and available in the system path
@@ -213,7 +225,8 @@ function Remove-PlatformLandingZone {
213225
[int]$throttleLimit = 11,
214226
[switch]$planMode,
215227
[switch]$skipDefenderPlanReset,
216-
[switch]$skipDeploymentDeletion
228+
[switch]$skipDeploymentDeletion,
229+
[switch]$skipOrphanedRoleAssignmentDeletion
217230
)
218231

219232
function Write-ToConsoleLog {
@@ -570,7 +583,7 @@ function Remove-PlatformLandingZone {
570583
}
571584

572585
# Delete orphaned role assignments from target management groups that are not being deleted
573-
if($managementGroupsFound.Count -ne 0) {
586+
if($managementGroupsFound.Count -ne 0 -and -not $skipOrphanedRoleAssignmentDeletion) {
574587
$managementGroupsFound | ForEach-Object -Parallel {
575588
$managementGroupId = $_.Name
576589
$managementGroupDisplayName = $_.DisplayName
@@ -616,6 +629,8 @@ function Remove-PlatformLandingZone {
616629
Write-ToConsoleLog "Skipping orphaned role assignment deletion for management group: $managementGroupId ($managementGroupDisplayName) as it is being deleted" -NoNewLine
617630
}
618631
} -ThrottleLimit $throttleLimit
632+
} elseif($managementGroupsFound.Count -ne 0) {
633+
Write-ToConsoleLog "Skipping orphaned role assignment deletion for all management groups as requested" -NoNewLine
619634
}
620635
}
621636

@@ -805,36 +820,40 @@ function Remove-PlatformLandingZone {
805820
Write-ToConsoleLog "Skipping subscription level deployment deletion in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
806821
}
807822

808-
Write-ToConsoleLog "Checking for orphaned role assignments to delete in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
809-
$roleAssignments = (az role assignment list --subscription $subscription.Id --query "[?principalName==''].{id:id,principalId:principalId,roleDefinitionName:roleDefinitionName}" -o json) | ConvertFrom-Json
823+
if(-not $using:skipOrphanedRoleAssignmentDeletion) {
824+
Write-ToConsoleLog "Checking for orphaned role assignments to delete in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
825+
$roleAssignments = (az role assignment list --subscription $subscription.Id --query "[?principalName==''].{id:id,principalId:principalId,roleDefinitionName:roleDefinitionName}" -o json) | ConvertFrom-Json
810826

811-
if ($roleAssignments -and $roleAssignments.Count -gt 0) {
812-
Write-ToConsoleLog "Found $($roleAssignments.Count) orphaned role assignment(s) in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
827+
if ($roleAssignments -and $roleAssignments.Count -gt 0) {
828+
Write-ToConsoleLog "Found $($roleAssignments.Count) orphaned role assignment(s) in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
813829

814-
$roleAssignments | ForEach-Object -Parallel {
815-
$roleAssignment = $_
816-
$subscription = $using:subscription
817-
$funcWriteToConsoleLog = $using:funcWriteToConsoleLog
818-
${function:Write-ToConsoleLog} = $funcWriteToConsoleLog
830+
$roleAssignments | ForEach-Object -Parallel {
831+
$roleAssignment = $_
832+
$subscription = $using:subscription
833+
$funcWriteToConsoleLog = $using:funcWriteToConsoleLog
834+
${function:Write-ToConsoleLog} = $funcWriteToConsoleLog
819835

820-
Write-ToConsoleLog "Deleting orphaned role assignment: $($roleAssignment.roleDefinitionName) for principal: $($roleAssignment.principalId) from subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
821-
$result = $null
822-
if($using:planMode) {
823-
Write-ToConsoleLog "(Plan Mode) Would run: az role assignment delete --ids $($roleAssignment.id)" -NoNewLine -Color Gray
824-
} else {
825-
$result = az role assignment delete --ids $roleAssignment.id 2>&1
826-
}
836+
Write-ToConsoleLog "Deleting orphaned role assignment: $($roleAssignment.roleDefinitionName) for principal: $($roleAssignment.principalId) from subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
837+
$result = $null
838+
if($using:planMode) {
839+
Write-ToConsoleLog "(Plan Mode) Would run: az role assignment delete --ids $($roleAssignment.id)" -NoNewLine -Color Gray
840+
} else {
841+
$result = az role assignment delete --ids $roleAssignment.id 2>&1
842+
}
827843

828-
if (!$result) {
829-
Write-ToConsoleLog "Deleted orphaned role assignment: $($roleAssignment.roleDefinitionName) from subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
830-
} else {
831-
Write-ToConsoleLog "Failed to delete orphaned role assignment: $($roleAssignment.roleDefinitionName) from subscription: $($subscription.Name) (ID: $($subscription.Id))" -IsWarning -NoNewLine
832-
}
833-
} -ThrottleLimit $using:throttleLimit
844+
if (!$result) {
845+
Write-ToConsoleLog "Deleted orphaned role assignment: $($roleAssignment.roleDefinitionName) from subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
846+
} else {
847+
Write-ToConsoleLog "Failed to delete orphaned role assignment: $($roleAssignment.roleDefinitionName) from subscription: $($subscription.Name) (ID: $($subscription.Id))" -IsWarning -NoNewLine
848+
}
849+
} -ThrottleLimit $using:throttleLimit
834850

835-
Write-ToConsoleLog "All orphaned role assignments processed in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
851+
Write-ToConsoleLog "All orphaned role assignments processed in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
852+
} else {
853+
Write-ToConsoleLog "No orphaned role assignments found in subscription: $($subscription.Name) (ID: $($subscription.Id)), skipping." -NoNewLine
854+
}
836855
} else {
837-
Write-ToConsoleLog "No orphaned role assignments found in subscription: $($subscription.Name) (ID: $($subscription.Id)), skipping." -NoNewLine
856+
Write-ToConsoleLog "Skipping orphaned role assignment deletion in subscription: $($subscription.Name) (ID: $($subscription.Id))" -NoNewLine
838857
}
839858

840859
} -ThrottleLimit $throttleLimit

0 commit comments

Comments
 (0)