Get-AzureRoleAssignmentAuditReport

<#
.SYNOPSIS
    Audits role assignments across the subscription.

.DESCRIPTION
    Exports every role assignment with scope, principal name and role,
    and specifically flags Owner role grants at the subscription level,
    since that role should be held by very few people and is worth
    reviewing on its own.

.PARAMETER ExportPath
    Path to write the CSV to. Defaults to the current directory.

.EXAMPLE
    .\Get-AzureRoleAssignmentAuditReport.ps1

.NOTES
    Requires the Az.Resources module and an active Connect-AzAccount session.

.AUTHOR
    Shehryar Hassan
#>

param(
    [string]$ExportPath = (Get-Location).Path
)

$assignments = Get-AzRoleAssignment

$report = $assignments | Select-Object DisplayName, SignInName, RoleDefinitionName, Scope,
    @{N="SubscriptionLevelOwner";E={$_.RoleDefinitionName -eq "Owner" -and $_.Scope -match "^/subscriptions/[^/]+$"}}

$file = Join-Path $ExportPath "role-assignment-audit_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
$report | Export-Csv -Path $file -NoTypeInformation

$owners = $report | Where-Object SubscriptionLevelOwner
Write-Warning "$($owners.Count) subscription level Owner assignment(s) found. Full export at $file"