How to retrieve role condition from ARM API

Question

How to retrieve role condition from ARM API

Neel Manthani 20

I am using the Terraform azapi provider to pull ARM objects using the Azure API.

Specifically, I am trying to pull role definitions. Using this API version: Microsoft.Authorization/roleDefinitions@2022-04-01, I am able to get all information about a role definition EXCEPT for the condition. My question is how do I get the condition field? I can see the condition field when using resource graph explorer to view roles, but not in the retrieved ARM API objects.

0 comments

Answer accepted by question author

Jose Benjamin Solis Nolasco 12,601 Volunteer Moderator

Welcome to Microsoft Q&A

Hello @Neel Manthani I hope you are doing well,

The reason you are not seeing the condition field in the API response is due to the specific API version you are targeting.

While API version 2022-04-01 was the milestone release that brought Attribute-Based Access Control (ABAC) conditions to General Availability for Role Assignments, the schema for Role Definitions did not immediately expose the corresponding built-in condition properties.

According to the Azure REST API changelog, the condition and conditionVersion fields were not added to the Microsoft.Authorization/roleDefinitions schema until the 2022-05-01-preview API version. Resource Graph Explorer uses newer/internal API versions by default, which is why you can see the field there but not in your Terraform outputs.

How to resolve this: Update your azapi Terraform configuration to use the newer API version:

Change your type string to Microsoft.Authorization/roleDefinitions@2022-05-01-preview (or a newer available version).

Note that the condition field is not located at the root of properties. Because a role definition can have multiple permission sets, the condition is nested inside the permissions array.

Once you update the API version, you will find the condition field in the retrieved JSON object at this path: properties.permissions[0].condition

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily.

Jose Benjamin Solis Nolasco 12,601 Reputation points Volunteer Moderator

2026-06-17T23:34:47.47+00:00

@Neel Manthani Just following up do you need more guidance or assistance?
Neel Manthani 20 Reputation points

2026-06-18T15:05:23.6433333+00:00

Thanks Jose, that partially fixed the issue, but now I'm finding that one desired role in particular is not being retrieved, namely the "Foundational RP Contributor" role. Interestingly, it appears in resource graph explorer queries, but does not display when running the az role definition list --name "Foundational RP Contributor".

What is the reason for this discrepancy?
Jose Benjamin Solis Nolasco 12,601 Reputation points Volunteer Moderator

2026-06-22T18:38:16.1033333+00:00
@Neel Manthani Check please the following things:

Ignore Internal Roles: Because "Foundational RP Contributor" is a hidden, Microsoft-managed system role, you cannot pull, assign, or manage it using the Azure CLI or Terraform. You should update your code to safely filter out or exclude this specific role from your automated retrieval logic.

Understand Custom Role Scoping: For future troubleshooting, if a Custom Role you created is ever missing from the CLI but visible in ARG, it usually means the role is scoped at the Management Group level. The CLI and Terraform providers default to querying the active Subscription scope, so you must explicitly pass the --scope parameter (pointing to the exact Management Group ID) to retrieve it.

References

List Azure role definitions - Azure RBAC

Understand Azure role definitions

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily.

1 additional answer

Your answer

Jose Benjamin Solis Nolasco 12,601 Reputation points Volunteer Moderator

2026-06-17T23:34:47.47+00:00

@Neel Manthani Just following up do you need more guidance or assistance?
Neel Manthani 20 Reputation points

2026-06-18T15:05:23.6433333+00:00

Thanks Jose, that partially fixed the issue, but now I'm finding that one desired role in particular is not being retrieved, namely the "Foundational RP Contributor" role. Interestingly, it appears in resource graph explorer queries, but does not display when running the az role definition list --name "Foundational RP Contributor".

What is the reason for this discrepancy?
Jose Benjamin Solis Nolasco 12,601 Reputation points Volunteer Moderator

2026-06-22T18:38:16.1033333+00:00

@Neel Manthani Check please the following things:

Ignore Internal Roles: Because "Foundational RP Contributor" is a hidden, Microsoft-managed system role, you cannot pull, assign, or manage it using the Azure CLI or Terraform. You should update your code to safely filter out or exclude this specific role from your automated retrieval logic.

Understand Custom Role Scoping: For future troubleshooting, if a Custom Role you created is ever missing from the CLI but visible in ARG, it usually means the role is scoped at the Management Group level. The CLI and Terraform providers default to querying the active Subscription scope, so you must explicitly pass the --scope parameter (pointing to the exact Management Group ID) to retrieve it.

References

List Azure role definitions - Azure RBAC

Understand Azure role definitions

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily.

Answer 1

Hi @Neel Manthani ,

When you call the ARM API for role definitions (Microsoft.Authorization/roleDefinitions@2022-04-01), the payload represents the definition of permissions (for example, actions, dataActions, etc.).

The RBAC condition (and related conditionVersion) is not a property of role definitions in ARM. It’s a property that exists only on role assignments (Microsoft.Authorization/roleAssignments), i.e., it’s evaluated as part of “who has which permissions, under what condition”.

So, even though you may see condition when using Resource Graph Explorer (because it can aggregate/compute RBAC view data), the raw roleDefinitions ARM objects won’t include condition.

If your goal is to retrieve the condition, you should query role assignments for the relevant scope(s) and filter for the role definition you care about. In other words:

Use Microsoft.Authorization/roleAssignments to list role assignments
Read the condition / conditionVersion fields from those role assignment objects return it. To access condition, you need to query roleAssignments instead.