Registry / azure / azure-mgmt-authorization

azure-mgmt-authorization

library4.0.0pypypi✓ verified 25d ago

The Microsoft Azure Authorization Management Client Library for Python facilitates programmatic management of Azure Role-Based Access Control (RBAC), including role assignments, role definitions, and access policy assignments. It is currently at version 4.0.0 and follows the Azure SDK for Python's release cadence, with updates typically aligned with Azure REST API changes and security fixes.

azure auth-security

pip install azure-mgmt-authorization

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · AZURE-MGMT-AUTHORI

azure-mgmt-authorization

azurepythonv4.0.0

Install

3.2s avg

Import

579ms

Disk

35MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v4.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.620s · 36.2MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.2s · import 0.538s · 37MB

35MB installed

● package 35MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

AuthorizationManagementClient

✓ from azure.mgmt.authorization import AuthorizationManagementClient

DefaultAzureCredential

✓ from azure.identity import DefaultAzureCredential

This quickstart demonstrates how to authenticate with Azure using `DefaultAzureCredential` and list all role assignments within a specified Azure subscription using `AuthorizationManagementClient`. Ensure the `AZURE_SUBSCRIPTION_ID` environment variable is set.

import os from azure.identity import DefaultAzureCredential from azure.mgmt.authorization import AuthorizationManagementClient # Ensure AZURE_SUBSCRIPTION_ID is set in your environment variables subscription_id = os.environ.get("AZURE_SUBSCRIPTION_ID", "") if not subscription_id: raise ValueError("AZURE_SUBSCRIPTION_ID environment variable not set.") # Authenticate using DefaultAzureCredential # This will try several credential types in order (environment, managed identity, CLI, VS Code, etc.) credential = DefaultAzureCredential() # Create the Authorization Management Client client = AuthorizationManagementClient(credential, subscription_id) print(f"Listing role assignments for subscription ID: {subscription_id}") try: # List all role assignments in the subscription for assignment in client.role_assignments.list(): print(f" - Scope: {assignment.scope}, Principal: {assignment.principal_id}, Role Definition: {assignment.role_definition_id.split('/')[-1]}") except Exception as e: print(f"An error occurred: {e}")

Debug

Known issues

breakingVersion 4.0.0 introduced significant breaking changes. The client constructor's signature may have changed, and model objects are now directly accessible under `azure.mgmt.authorization.models` instead of nested sub-modules (e.g., `authorization.models.authorization`).

fix

Review the official changelog for v4.0.0. Update client instantiation, model imports, and method calls to align with the new API surface. For models, remove extra sub-module names like `.authorization`.

affects: 4.0.0 and newer (from 3.x)

breakingOlder versions of Azure SDKs often used `msrestazure.azure_exceptions.CloudError` or `msrest.exceptions.HttpOperationError` for service-side exceptions. Modern Azure SDKs, including `azure-mgmt-authorization`, now raise `azure.core.exceptions.HttpResponseError`.

fix

Update exception handling blocks to catch `HttpResponseError` from `azure.core.exceptions`. Import `HttpResponseError` and adjust `except` clauses accordingly.

affects: 4.0.0 and newer (from 3.x)

gotchaAuthentication in Azure SDKs has standardized on the `azure-identity` package. Avoid using older, deprecated credential classes from `msrestazure` or directly managing tokens, as they may lead to security vulnerabilities or lack support for modern authentication flows like Managed Identities.

fix

Always use classes from `azure.identity` (e.g., `DefaultAzureCredential`, `EnvironmentCredential`, `ManagedIdentityCredential`) for authentication. Refer to the `azure-identity` documentation for the most robust authentication practices.

affects: All versions (migration from older SDK patterns)

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'azure.mgmt.authorization.v20xx_yy_zz'

This error typically occurs when attempting to import client or model classes from an outdated or incorrect API version-specific sub-module path, which might no longer exist or has been refactored in `azure-mgmt-authorization` version 4.0.0 and newer.

fix

Ensure `azure-mgmt-authorization` is updated to version 4.0.0 or later. Update your import statements to use the simplified top-level import for the client: `from azure.mgmt.authorization import AuthorizationManagementClient`. If a specific API version's models or operations are absolutely required, import directly from `azure.mgmt.authorization.vYYYY_MM_DD` (e.g., `from azure.mgmt.authorization.v2022_04_01 import AuthorizationManagementClient`) rather than deeply nested sub-modules.

AttributeError: 'DefaultAzureCredential' object has no attribute 'signed_session'

This `AttributeError` arises from a compatibility mismatch: an older version of `azure-mgmt-authorization` (pre-4.0.0) is being used with a newer `azure-identity` credential (like `DefaultAzureCredential`). Older management clients expected credentials from `msrestazure` or `azure.common.credentials` which exposed a `signed_session` attribute, while `azure-identity` credentials do not.

fix

Upgrade `azure-mgmt-authorization` to version 4.0.0 or newer and ensure `azure-identity` is also up to date. The latest versions of the management libraries are designed to natively accept `azure-identity` credentials without requiring the `signed_session` attribute.

{"error":{"code":"AuthorizationFailed","message":"The client '{client_id}' with object id '{object_id}' does not have authorization to perform action '{action_name}' over scope '{scope}' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

This error indicates that the Azure Active Directory principal (user, service principal, or managed identity) used for authentication lacks the necessary Role-Based Access Control (RBAC) permissions to perform the requested authorization management action on the specified Azure resource or scope.

fix

Grant the required RBAC roles (e.g., 'Contributor' and 'User Access Administrator' for creating role assignments) to the client ID or object ID on the relevant scope (e.g., subscription, resource group, or resource). After granting permissions, it might be necessary to refresh credentials or wait a few minutes for the changes to propagate across Azure.

Upgrade

Version history

4.0.0latest on PyPI · released Jul 25, 2023

Audit

Dependencies

azure-mgmt-corerequiredProvides core functionalities for Azure Management libraries.

azure-identityrequiredStandard library for Azure authentication.

Agent activity

31 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/Azure/azure-sdk-for-python ↗

packagehttps://pypi.org/project/azure-mgmt-authorization/ ↗

homepagehttps://azure.microsoft.com ↗