Automating Azure Resource Elevated Role Requests with Power Automate and Azure Automation

param (
    [Parameter(Mandatory = $true)]
    [string] $subscriptionId,
    [Parameter(Mandatory = $true)]
    [string] $resourceGroupName,
    [Parameter(Mandatory = $true)]
    [string] $resourceName,
    [Parameter(Mandatory = $true)]
    [string] $resourceType,
    [Parameter(Mandatory = $true)]
    [string] $userPrincipalName,
    [Parameter(Mandatory = $false)]
    [string] $linkUrl
)

$ErrorActionPreference = "Continue"
$errors = @()
function Send-Email($subject, $body, $to, $cc = $null, $isBodyHtml = $false) {
    $credential = Get-AutomationPSCredential -Name 'SMTP Relay'
    $smtpServer =  'smtp.example.com'
    $smtpPort =  <Int32>
    $from =  'example@examplecompany.com'
    $mailParams = @{
        To         = $to
        Subject    = $subject
        Body       = $body
        SmtpServer = $smtpServer
        Credential = $credential
        Port       = $smtpPort
        UseSsl     = $true
        From       = $from
        BodyAsHtml = $isBodyHtml
    }
    if ($cc) {
        $mailParams['Cc'] = $cc
    }
    Send-MailMessage @mailParams -ErrorAction Stop
}
try {
    $connection = Connect-AzAccount -Identity
} catch {
    $errors += "Failed to authenticate with Azure using Managed Identity: $_"
}
try {
    Set-AzContext -SubscriptionId $subscriptionId
} catch {
    $errors += "Failed to set Azure subscription context: $_"
}
$roleDefinitionName = 'Contributor'
$readerRoleDefinitionName = 'Reader'
try {
    $user = Get-AzADUser -UserPrincipalName $userPrincipalName -ErrorAction Stop
} catch {
    $errors += "Failed to retrieve user object for UPN '$userPrincipalName': $_"
}
# Check if the user has the Reader role at the subscription level
$readerRoleAssignment = Get-AzRoleAssignment -ObjectId $user.Id -RoleDefinitionName $readerRoleDefinitionName -Scope "/subscriptions/$subscriptionId" -ErrorAction SilentlyContinue
if (-not $readerRoleAssignment) {
    $noReaderRoleHtml = @"
    <h2>Not in Reader Role</h2>

<p>User <strong>$userPrincipalName</strong> does not have the <strong>$readerRoleDefinitionName</strong> role at the subscription level and cannot be added to the <strong>$roleDefinitionName</strong> role for the resource.</p>
"@
    $noReaderRoleHtml += $signature
  Send-Email -subject "Missing Reader Role" -body $noReaderRoleHtml -to $userPrincipalName -cc "itadministrator@examplecompany.com" -isBodyHtml $true
    return
}

# Check if the resource group exists
$resourceGroupExists = $true
$resourceGroup = Get-AzResourceGroup -Name $resourceGroupName -ErrorAction SilentlyContinue
if (-not $resourceGroup) {
    $errors += "Resource group '$resourceGroupName' does not exist."
    $resourceGroupExists = $false
}

# Check if the resource exists within the resource group
  $domain = "yourdomain.onmicrosoft.com" # replace this with your actual AAD tenant domain

# Check if the resource exists within the resource group using both name and type
$resourceExists = $false
$resourceUrl = ""
if ($resourceGroupExists) {
    $resources = Get-AzResource -ResourceGroupName $resourceGroupName -ResourceType $resourceType -Name $resourceName -ErrorAction SilentlyContinue
    $resource = $resources | Where-Object { $_.ResourceType -eq $resourceType -and $_.Name -eq $resourceName }
    if ($resource) {
        $resourceExists = $true
        # Construct the URL using the domain, resource group, resource type, and resource name
        $resourceUrl = "https://portal.azure.com/#@$domain/resourcegroups/$resourceGroupName/providers/$($resource.ResourceType)/$resourceName"
    } else {
        $errors += "Resource of type '$resourceType' with name '$resourceName' does not exist in resource group '$resourceGroupName'."
    }
}

# Attempt role assignment only if resource group and resource exist
if ($resourceGroupExists -and $resourceExists) {
    try {
        $roleAssignment = New-AzRoleAssignment -ObjectId $user.Id -RoleDefinitionName $roleDefinitionName -Scope $resource.ResourceId -ErrorAction Stop
    } catch {
        if ($_.Exception -match 'Conflict') {
            # User already has the Contributor role, send a specific email
            $alreadyContributorHtml = @"
<h2>User Already a Contributor</h2> 

            <p>User <strong>$userPrincipalName</strong> already has the <strong>$roleDefinitionName</strong> role for resource <strong>$resourceName</strong>.</p> 

            <p>Resource URL: <a href='$linkUrl'>$linkUrl</a></p>

"@ 

            $alreadyContributorHtml += $signature 

  Send-Email -subject "User Already Has Contributor Role" -body $alreadyContributorHtml -to $userPrincipalName -cc "itadministrator@examplecompany.com" -isBodyHtml $true 

        } else { 

            $errors += "Failed to assign role '$roleDefinitionName' to user '$userPrincipalName': $_" 

        } 

    } 

} 

$signature = @" 

<p>Best regards,</p> 

<p><strong>Your IT Team</strong></p>

<p><em>This is an automated message, please do not reply directly to this email.</em></p> 

"@ 

if ($errors) { 

    $errorMessageHtml = "<h2>Issues Detected in Azure Role Assignment</h2><ul>" 

    foreach ($errorItem in $errors) { 

        $errorMessageHtml += "<li>$errorItem</li>" 

    } 

    $errorMessageHtml += "</ul>$signature" 

  Send-Email -subject "Azure Role Assignment Issues" -body $errorMessageHtml -to $userPrincipalName -cc "itadministrator@examplecompany.com" -isBodyHtml $true 

} elseif ($roleAssignment) { 

    # Role assignment was successful, send a success email 

    $successMessageHtml = @" 

    <h2>Role Assignment Success</h2> 

    <p>User <strong>$userPrincipalName</strong> was successfully assigned the <strong>$roleDefinitionName</strong> role for resource <strong>$resourceName</strong>.</p> 

    <p>Resource URL: <a href='$linkUrl'>$linkUrl</a></p>

"@ 

    $successMessageHtml += $signature 

  Send-Email -subject "Azure Role Assignment Success" -body $successMessageHtml -to $userPrincipalName -cc "itadministrator@examplecompany.com" -isBodyHtml $true 

}

  param ( 
    [Parameter(Mandatory = $true)] 
    [string] $subscriptionId, 
    [Parameter(Mandatory = $true)] 
    [string] $resourceGroupName, 
    [Parameter(Mandatory = $true)] 
    [string] $resourceName, 
    [Parameter(Mandatory = $true)] 
    [string] $resourceType, 
    [Parameter(Mandatory = $true)] 
    [string] $userPrincipalName, 
    [Parameter(Mandatory = $false)] 
    [string] $linkUrl 
) 

$ErrorActionPreference = "Continue" 
$errors = @() 
$signature = @" 

 
<p>Best regards,</p> 
<p><strong>Your IT Team</strong></p> 
<p><em>This is an automated message, please do not reply directly to this email.</em></p> 
"@ 

function Send-Email($subject, $body, $to, $cc = $null, $isBodyHtml = $false) { 

    $credential = Get-AutomationPSCredential -Name 'SMTP Relay' 
  $smtpServer = 'smtp.example.com' 
  $smtpPort = <int 32>
  $from = 'example@examplecompany.com' 
    $mailParams = @{ 
        To         = $to 
        Subject    = $subject 
        Body       = $body 
        SmtpServer = $smtpServer 
        Credential = $credential 
        Port       = $smtpPort 
        UseSsl     = $true 
        From       = $from 
        BodyAsHtml = $isBodyHtml 
    } 
    if ($cc) { 
        $mailParams['Cc'] = $cc 
    } 
    Send-MailMessage @mailParams -ErrorAction Stop 
} 

try { 
    $connection = Connect-AzAccount -Identity 
} catch { 
    $errors += "Failed to authenticate with Azure using Managed Identity: $_" 
} 

try {
    Set-AzContext -SubscriptionId $subscriptionId 

} catch { 
    $errors += "Failed to set Azure subscription context: $_" 
} 

$roleDefinitionName = 'Contributor' 

try { 
    $user = Get-AzADUser -UserPrincipalName $userPrincipalName -ErrorAction Stop 
} catch { 
    $errors += "Failed to retrieve user object for UPN '$userPrincipalName': $_" 
} 

Not in Reader Role

# Check if the resource group exists and get the resource 
$resourceGroupExists = $resourceExists = $false 
if ((Get-AzResourceGroup -Name $resourceGroupName -ErrorAction SilentlyContinue)) { 
    $resourceGroupExists = $true 
    $resources = Get-AzResource -ResourceGroupName $resourceGroupName -ResourceType $resourceType -Name $resourceName -ErrorAction SilentlyContinue 
    $resource = $resources | Where-Object { $_.ResourceType -eq $resourceType -and $_.Name -eq $resourceName } 

    if ($resource) { 

        $resourceExists = $true 

    } else { 
        $errors += "Resource of type '$resourceType' with name '$resourceName' does not exist in resource group '$resourceGroupName'." 
    } 
} else { 

    $errors += "Resource group '$resourceGroupName' does not exist." 
} 

# Attempt to remove the role assignment if resource group and resource exist 

if ($resourceGroupExists -and $resourceExists) { 
    try { 

        $roleAssignments = Get-AzRoleAssignment -ObjectId $user.Id -RoleDefinitionName $roleDefinitionName -Scope $resource.ResourceId -ErrorAction SilentlyContinue 

        foreach ($roleAssignment in $roleAssignments) { 

            # Note: Confirmation suppression will work if the cmdlet supports it.  
            Remove-AzRoleAssignment -ObjectId $user.Id -RoleDefinitionName $roleDefinitionName -Scope $resource.ResourceId -Confirm:$false 

        } 

        # Check if role assignments are successfully removed 
        if (-not (Get-AzRoleAssignment -ObjectId $user.Id -RoleDefinitionName $roleDefinitionName -Scope $resource.ResourceId -ErrorAction SilentlyContinue)) { 

            # If removal is successful, send a success email 
            $successMessageHtml = @" 
            <h2>Role Removal Success</h2> 
            <p>User <strong>$userPrincipalName</strong> was successfully removed from the <strong>$roleDefinitionName</strong> role for resource <strong>$resourceName</strong>.</p>
            <p>Resource URL: <a href='$linkUrl'>$linkUrl</a></p> 
"@ 
            $successMessageHtml += $signature 
  Send-Email -subject "Azure Role Removal Success" -body $successMessageHtml -to $userPrincipalName -cc "itadministrator@examplecompany.com " -isBodyHtml $true 
        } else { 
            $errors += "Role '$roleDefinitionName' still exists for user '$userPrincipalName' after removal attempt." 
        } 

    } catch { 
        $errors += "Failed to remove role '$roleDefinitionName' from user '$userPrincipalName': $_" 
    } 

} 

if ($errors) { 
    $errorMessageHtml = "<h2>Issues Detected in Azure Role Removal</h2><ul>" 
    foreach ($errorItem in $errors) { 
        $errorMessageHtml += "<li>$errorItem</li>" 
    } 
    $errorMessageHtml += "</ul>$signature" 
  Send-Email -subject "Azure Role Removal Issues" -body $errorMessageHtml -to $userPrincipalName -cc "itadministrator@examplecompany.com" -isBodyHtml $true 

}