azure-native.authorization.getDenyAssignment

Azure Native v3.25.0, Aug 5 26

This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.

Viewing docs for Azure Native v3.25.0
published on Wednesday, Aug 5, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-azure-native

This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.

Viewing docs for Azure Native v3.25.0
published on Wednesday, Aug 5, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-azure-native

Using getDenyAssignment

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getDenyAssignment(args: GetDenyAssignmentArgs, opts?: InvokeOptions): Promise<GetDenyAssignmentResult>
function getDenyAssignmentOutput(args: GetDenyAssignmentOutputArgs, opts?: InvokeOptions): Output<GetDenyAssignmentResult>

def get_deny_assignment(deny_assignment_id: Optional[str] = None,
                        scope: Optional[str] = None,
                        opts: Optional[InvokeOptions] = None) -> GetDenyAssignmentResult
def get_deny_assignment_output(deny_assignment_id: pulumi.Input[Optional[str]] = None,
                        scope: pulumi.Input[Optional[str]] = None,
                        opts: Optional[InvokeOptions] = None) -> Output[GetDenyAssignmentResult]

func LookupDenyAssignment(ctx *Context, args *LookupDenyAssignmentArgs, opts ...InvokeOption) (*LookupDenyAssignmentResult, error)
func LookupDenyAssignmentOutput(ctx *Context, args *LookupDenyAssignmentOutputArgs, opts ...InvokeOption) LookupDenyAssignmentResultOutput

> Note: This function is named LookupDenyAssignment in the Go SDK.

public static class GetDenyAssignment 
{
    public static Task<GetDenyAssignmentResult> InvokeAsync(GetDenyAssignmentArgs args, InvokeOptions? opts = null)
    public static Output<GetDenyAssignmentResult> Invoke(GetDenyAssignmentInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetDenyAssignmentResult> getDenyAssignment(GetDenyAssignmentArgs args, InvokeOptions options)
public static Output<GetDenyAssignmentResult> getDenyAssignment(GetDenyAssignmentArgs args, InvokeOptions options)

fn::invoke:
  function: azure-native:authorization:getDenyAssignment
  arguments:
    # arguments dictionary

data "azure-native_authorization_get_deny_assignment" "name" {
    # arguments
}

The following arguments are supported:

DenyAssignmentId string: The ID of the deny assignment to get.
Scope string: The fully qualified Azure Resource manager identifier of the resource.

DenyAssignmentId string: The ID of the deny assignment to get.
Scope string: The fully qualified Azure Resource manager identifier of the resource.

deny_assignment_id string: The ID of the deny assignment to get.
scope string: The fully qualified Azure Resource manager identifier of the resource.

denyAssignmentId String: The ID of the deny assignment to get.
scope String: The fully qualified Azure Resource manager identifier of the resource.

denyAssignmentId string: The ID of the deny assignment to get.
scope string: The fully qualified Azure Resource manager identifier of the resource.

deny_assignment_id str: The ID of the deny assignment to get.
scope str: The fully qualified Azure Resource manager identifier of the resource.

denyAssignmentId String: The ID of the deny assignment to get.
scope String: The fully qualified Azure Resource manager identifier of the resource.

getDenyAssignment Result

The following output properties are available:

AzureApiVersion string: The Azure API version of the resource.
CreatedBy string: Id of the user who created the assignment
CreatedOn string: Time it was created
Id string: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
Name string: The name of the resource
Scope string: The deny assignment scope.
SystemData Pulumi.AzureNative.Authorization.Outputs.SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
UpdatedBy string: Id of the user who updated the assignment
UpdatedOn string: Time it was updated
Condition string: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
ConditionVersion string: Version of the condition.
DenyAssignmentEffect string: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
DenyAssignmentName string: The display name of the deny assignment.
Description string: The description of the deny assignment.
DoNotApplyToChildScopes bool: Determines if the deny assignment applies to child scopes. Default value is false.
ExcludePrincipals List<Pulumi.AzureNative.Authorization.Outputs.DenyAssignmentPrincipalResponse>: Array of principals to which the deny assignment does not apply.
IsSystemProtected bool: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
Permissions List<Pulumi.AzureNative.Authorization.Outputs.DenyAssignmentPermissionResponse>: An array of permissions that are denied by the deny assignment.
Principals List<Pulumi.AzureNative.Authorization.Outputs.DenyAssignmentPrincipalResponse>: Array of principals to which the deny assignment applies.

AzureApiVersion string: The Azure API version of the resource.
CreatedBy string: Id of the user who created the assignment
CreatedOn string: Time it was created
Id string: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
Name string: The name of the resource
Scope string: The deny assignment scope.
SystemData SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
UpdatedBy string: Id of the user who updated the assignment
UpdatedOn string: Time it was updated
Condition string: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
ConditionVersion string: Version of the condition.
DenyAssignmentEffect string: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
DenyAssignmentName string: The display name of the deny assignment.
Description string: The description of the deny assignment.
DoNotApplyToChildScopes bool: Determines if the deny assignment applies to child scopes. Default value is false.
ExcludePrincipals []DenyAssignmentPrincipalResponse: Array of principals to which the deny assignment does not apply.
IsSystemProtected bool: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
Permissions []DenyAssignmentPermissionResponse: An array of permissions that are denied by the deny assignment.
Principals []DenyAssignmentPrincipalResponse: Array of principals to which the deny assignment applies.

azure_api_version string: The Azure API version of the resource.
created_by string: Id of the user who created the assignment
created_on string: Time it was created
id string: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name string: The name of the resource
scope string: The deny assignment scope.
system_data object: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
updated_by string: Id of the user who updated the assignment
updated_on string: Time it was updated
condition string: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
condition_version string: Version of the condition.
deny_assignment_effect string: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
deny_assignment_name string: The display name of the deny assignment.
description string: The description of the deny assignment.
do_not_apply_to_child_scopes bool: Determines if the deny assignment applies to child scopes. Default value is false.
exclude_principals list(object): Array of principals to which the deny assignment does not apply.
is_system_protected bool: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
permissions list(object): An array of permissions that are denied by the deny assignment.
principals list(object): Array of principals to which the deny assignment applies.

azureApiVersion String: The Azure API version of the resource.
createdBy String: Id of the user who created the assignment
createdOn String: Time it was created
id String: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name String: The name of the resource
scope String: The deny assignment scope.
systemData SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
updatedBy String: Id of the user who updated the assignment
updatedOn String: Time it was updated
condition String: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
conditionVersion String: Version of the condition.
denyAssignmentEffect String: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
denyAssignmentName String: The display name of the deny assignment.
description String: The description of the deny assignment.
doNotApplyToChildScopes Boolean: Determines if the deny assignment applies to child scopes. Default value is false.
excludePrincipals List<DenyAssignmentPrincipalResponse>: Array of principals to which the deny assignment does not apply.
isSystemProtected Boolean: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
permissions List<DenyAssignmentPermissionResponse>: An array of permissions that are denied by the deny assignment.
principals List<DenyAssignmentPrincipalResponse>: Array of principals to which the deny assignment applies.

azureApiVersion string: The Azure API version of the resource.
createdBy string: Id of the user who created the assignment
createdOn string: Time it was created
id string: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name string: The name of the resource
scope string: The deny assignment scope.
systemData SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type string: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
updatedBy string: Id of the user who updated the assignment
updatedOn string: Time it was updated
condition string: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
conditionVersion string: Version of the condition.
denyAssignmentEffect string: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
denyAssignmentName string: The display name of the deny assignment.
description string: The description of the deny assignment.
doNotApplyToChildScopes boolean: Determines if the deny assignment applies to child scopes. Default value is false.
excludePrincipals DenyAssignmentPrincipalResponse[]: Array of principals to which the deny assignment does not apply.
isSystemProtected boolean: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
permissions DenyAssignmentPermissionResponse[]: An array of permissions that are denied by the deny assignment.
principals DenyAssignmentPrincipalResponse[]: Array of principals to which the deny assignment applies.

azure_api_version str: The Azure API version of the resource.
created_by str: Id of the user who created the assignment
created_on str: Time it was created
id str: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name str: The name of the resource
scope str: The deny assignment scope.
system_data SystemDataResponse: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type str: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
updated_by str: Id of the user who updated the assignment
updated_on str: Time it was updated
condition str: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
condition_version str: Version of the condition.
deny_assignment_effect str: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
deny_assignment_name str: The display name of the deny assignment.
description str: The description of the deny assignment.
do_not_apply_to_child_scopes bool: Determines if the deny assignment applies to child scopes. Default value is false.
exclude_principals Sequence[DenyAssignmentPrincipalResponse]: Array of principals to which the deny assignment does not apply.
is_system_protected bool: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
permissions Sequence[DenyAssignmentPermissionResponse]: An array of permissions that are denied by the deny assignment.
principals Sequence[DenyAssignmentPrincipalResponse]: Array of principals to which the deny assignment applies.

azureApiVersion String: The Azure API version of the resource.
createdBy String: Id of the user who created the assignment
createdOn String: Time it was created
id String: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name String: The name of the resource
scope String: The deny assignment scope.
systemData Property Map: Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
updatedBy String: Id of the user who updated the assignment
updatedOn String: Time it was updated
condition String: The conditions on the deny assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'
conditionVersion String: Version of the condition.
denyAssignmentEffect String: The effect of the deny assignment. 'enforced' blocks access, 'audit' logs without blocking.
denyAssignmentName String: The display name of the deny assignment.
description String: The description of the deny assignment.
doNotApplyToChildScopes Boolean: Determines if the deny assignment applies to child scopes. Default value is false.
excludePrincipals List<Property Map>: Array of principals to which the deny assignment does not apply.
isSystemProtected Boolean: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
permissions List<Property Map>: An array of permissions that are denied by the deny assignment.
principals List<Property Map>: Array of principals to which the deny assignment applies.

Supporting Types

DenyAssignmentPermissionResponse

Actions List<string>: Actions to which the deny assignment does not grant access.
Condition string: The conditions on the Deny assignment permission. This limits the resources it applies to.
ConditionVersion string: Version of the condition.
DataActions List<string>: Data actions to which the deny assignment does not grant access.
NotActions List<string>: Actions to exclude from that the deny assignment does not grant access.
NotDataActions List<string>: Data actions to exclude from that the deny assignment does not grant access.

Actions []string: Actions to which the deny assignment does not grant access.
Condition string: The conditions on the Deny assignment permission. This limits the resources it applies to.
ConditionVersion string: Version of the condition.
DataActions []string: Data actions to which the deny assignment does not grant access.
NotActions []string: Actions to exclude from that the deny assignment does not grant access.
NotDataActions []string: Data actions to exclude from that the deny assignment does not grant access.

actions list(string): Actions to which the deny assignment does not grant access.
condition string: The conditions on the Deny assignment permission. This limits the resources it applies to.
condition_version string: Version of the condition.
data_actions list(string): Data actions to which the deny assignment does not grant access.
not_actions list(string): Actions to exclude from that the deny assignment does not grant access.
not_data_actions list(string): Data actions to exclude from that the deny assignment does not grant access.

actions List<String>: Actions to which the deny assignment does not grant access.
condition String: The conditions on the Deny assignment permission. This limits the resources it applies to.
conditionVersion String: Version of the condition.
dataActions List<String>: Data actions to which the deny assignment does not grant access.
notActions List<String>: Actions to exclude from that the deny assignment does not grant access.
notDataActions List<String>: Data actions to exclude from that the deny assignment does not grant access.

actions string[]: Actions to which the deny assignment does not grant access.
condition string: The conditions on the Deny assignment permission. This limits the resources it applies to.
conditionVersion string: Version of the condition.
dataActions string[]: Data actions to which the deny assignment does not grant access.
notActions string[]: Actions to exclude from that the deny assignment does not grant access.
notDataActions string[]: Data actions to exclude from that the deny assignment does not grant access.

actions Sequence[str]: Actions to which the deny assignment does not grant access.
condition str: The conditions on the Deny assignment permission. This limits the resources it applies to.
condition_version str: Version of the condition.
data_actions Sequence[str]: Data actions to which the deny assignment does not grant access.
not_actions Sequence[str]: Actions to exclude from that the deny assignment does not grant access.
not_data_actions Sequence[str]: Data actions to exclude from that the deny assignment does not grant access.

actions List<String>: Actions to which the deny assignment does not grant access.
condition String: The conditions on the Deny assignment permission. This limits the resources it applies to.
conditionVersion String: Version of the condition.
dataActions List<String>: Data actions to which the deny assignment does not grant access.
notActions List<String>: Actions to exclude from that the deny assignment does not grant access.
notDataActions List<String>: Data actions to exclude from that the deny assignment does not grant access.

DenyAssignmentPrincipalResponse

Id string: The object ID of the principal.
Type string: The type of the principal such as user, group, servicePrincipal, etc.

Id string: The object ID of the principal.
Type string: The type of the principal such as user, group, servicePrincipal, etc.

id string: The object ID of the principal.
type string: The type of the principal such as user, group, servicePrincipal, etc.

id String: The object ID of the principal.
type String: The type of the principal such as user, group, servicePrincipal, etc.

id string: The object ID of the principal.
type string: The type of the principal such as user, group, servicePrincipal, etc.

id str: The object ID of the principal.
type str: The type of the principal such as user, group, servicePrincipal, etc.

id String: The object ID of the principal.
type String: The type of the principal such as user, group, servicePrincipal, etc.

SystemDataResponse

CreatedAt string: The timestamp of resource creation (UTC).
CreatedBy string: The identity that created the resource.
CreatedByType string: The type of identity that created the resource.
LastModifiedAt string: The timestamp of resource last modification (UTC)
LastModifiedBy string: The identity that last modified the resource.
LastModifiedByType string: The type of identity that last modified the resource.

CreatedAt string: The timestamp of resource creation (UTC).
CreatedBy string: The identity that created the resource.
CreatedByType string: The type of identity that created the resource.
LastModifiedAt string: The timestamp of resource last modification (UTC)
LastModifiedBy string: The identity that last modified the resource.
LastModifiedByType string: The type of identity that last modified the resource.

created_at string: The timestamp of resource creation (UTC).
created_by string: The identity that created the resource.
created_by_type string: The type of identity that created the resource.
last_modified_at string: The timestamp of resource last modification (UTC)
last_modified_by string: The identity that last modified the resource.
last_modified_by_type string: The type of identity that last modified the resource.

createdAt String: The timestamp of resource creation (UTC).
createdBy String: The identity that created the resource.
createdByType String: The type of identity that created the resource.
lastModifiedAt String: The timestamp of resource last modification (UTC)
lastModifiedBy String: The identity that last modified the resource.
lastModifiedByType String: The type of identity that last modified the resource.

createdAt string: The timestamp of resource creation (UTC).
createdBy string: The identity that created the resource.
createdByType string: The type of identity that created the resource.
lastModifiedAt string: The timestamp of resource last modification (UTC)
lastModifiedBy string: The identity that last modified the resource.
lastModifiedByType string: The type of identity that last modified the resource.

created_at str: The timestamp of resource creation (UTC).
created_by str: The identity that created the resource.
created_by_type str: The type of identity that created the resource.
last_modified_at str: The timestamp of resource last modification (UTC)
last_modified_by str: The identity that last modified the resource.
last_modified_by_type str: The type of identity that last modified the resource.

createdAt String: The timestamp of resource creation (UTC).
createdBy String: The identity that created the resource.
createdByType String: The type of identity that created the resource.
lastModifiedAt String: The timestamp of resource last modification (UTC)
lastModifiedBy String: The identity that last modified the resource.
lastModifiedByType String: The type of identity that last modified the resource.

Package Details

Repository: Azure Native pulumi/pulumi-azure-native
License: Apache-2.0

This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.

Viewing docs for Azure Native v3.25.0
published on Wednesday, Aug 5, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-azure-native

azure-native.authorization.getDenyAssignment

On this page

On this page

Using getDenyAssignment

getDenyAssignment Result

Supporting Types

DenyAssignmentPermissionResponse

DenyAssignmentPrincipalResponse

SystemDataResponse

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

azure-native.authorization.getDenyAssignment

On this page

On this page

Using getDenyAssignment

getDenyAssignment Result

Supporting Types

DenyAssignmentPermissionResponse

DenyAssignmentPrincipalResponse

SystemDataResponse

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.