#Connect-AzAccount

class ResourceCheck {
    [string] $ResourceId = ""
    [string] $Id = ""
    [string] $Kind = ""
    [string] $Location = ""
    [string] $ResourceName = ""
    [string] $ResourceGroupName = ""
    [string] $ResourceType = ""
    [string] $SubscriptionId = ""
    [string] $SubscriptionName = ""
    [string] $Tag_Team = ""
    [string] $Tag_Product = ""
    [string] $Tag_Environment = ""
    [string] $Tag_Data = ""
    [string] $Tag_Delete = ""
    [string] $Tag_Split = ""
    [string] $RBAC_RoleAssignmentId = ""
    [string] $RBAC_Scope = ""
    [string] $RBAC_DisplayName = ""
    [string] $RBAC_SignInName = ""
    [string] $RBAC_RoleDefinitionName = ""
}

Write-Host "========================================================================================================================================================================"
Write-Host "Creating resource RBAC assignment overview."
Write-Host "========================================================================================================================================================================"

$subscriptions = Get-AzSubscription | Where-Object State -eq "Enabled"

$fileName =  "c:\temp\2020-10-21 azure_rbac.csv" 
$fileExists = Test-Path $fileName
If ($fileExists -eq $True) {
    Remove-Item $fileName 
}

foreach ($subscription in $subscriptions) 
{
Set-AzContext -SubscriptionId $subscription.Id

    $allResources = Get-AzResource 
    
    foreach ($resource in $allResources) {

        [ResourceCheck[]]$Result = @()

        try {
            $roleAssignments = Get-AzRoleAssignment -ResourceGroupName $resource.ResourceGroupName -ResourceName $resource.ResourceName -ResourceType $resource.ResourceType # | Where-Object Scope -EQ "/"

            foreach($roleAssignment in $roleAssignments) {
            [ResourceCheck] $resourceCheck = [ResourceCheck]::new()
                $resourceCheck.ResourceId = $resource.ResourceId
                $resourceCheck.Id = $resource.Id
                $resourceCheck.Kind = $resource.Kind
                $resourceCheck.Location = $resource.Location
                $resourceCheck.ResourceName = $resource.ResourceName
                $resourceCheck.ResourceGroupName = $resource.ResourceGroupName
                $resourceCheck.ResourceType = $resource.ResourceType
                $resourceCheck.SubscriptionId = $subscription.Id
                $resourceCheck.SubscriptionName = $subscription.Name
                $resourceCheck.Tag_Team = $resource.Tags.team
                $resourceCheck.Tag_Product = $resource.Tags.product
                $resourceCheck.Tag_Environment = $resource.Tags.environment
                $resourceCheck.Tag_Data = $resource.Tags.data
                $resourceCheck.Tag_Delete = $resource.Tags.delete
                $resourceCheck.Tag_Split = $resource.Tags.split
                $resourceCheck.RBAC_RoleAssignmentId = $roleAssignment.RoleAssignmentId
                $resourceCheck.RBAC_Scope = $roleAssignment.Scope
                $resourceCheck.RBAC_DisplayName = $roleAssignment.DisplayName
                $resourceCheck.RBAC_SignInName = $roleAssignment.SignInName
                $resourceCheck.RBAC_RoleDefinitionName = $roleAssignment.RoleDefinitionName
                
                $Result += $resourceCheck
                }
        } catch {
        }
        $Result | Export-Csv -Path $fileName -Append -NoTypeInformation
    }
}

Write-Host "========================================================================================================================================================================"
Write-Host "Done."