Deny Assignments - Document Details

This page contains Windows bias

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.

View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types

powershell_heavy

missing_linux_example

windows_tools

windows_first

Summary

The documentation page demonstrates a Windows bias by providing detailed PowerShell examples (which are Windows-centric), referencing Windows file paths (e.g., 'PS C:\>'), and omitting equivalent command-line examples for Linux users (such as Azure CLI/bash). The only command-line automation example is with Azure PowerShell, with no mention or example of Azure CLI, which is cross-platform and commonly used on Linux. Additionally, the PowerShell tab appears before REST API, and there is no explicit guidance for Linux users.

Recommendations

Add Azure CLI examples for all PowerShell command examples, showing equivalent commands for listing deny assignments at different scopes.
Use neutral file path prompts (e.g., '$' or no prompt) in code blocks, or provide both Windows (PS C:\>) and Linux ($) prompts.
Explicitly mention that Azure PowerShell can be used cross-platform, but also highlight Azure CLI as a first-class, cross-platform alternative.
Reorder or parallelize the documentation tabs so that Azure CLI (if added) appears alongside or before PowerShell, or at least not after.
Include a section or note for Linux/macOS users, clarifying tool availability and usage.
Where screenshots or UI instructions are given, clarify if there are any OS-specific differences or confirm that the Azure portal experience is identical across platforms.

Create Pull Request

Scan History

Date	Scan	Status	Result
2026-01-14 00:00	#250	in_progress	Biased
2026-01-13 00:00	#246	completed	Biased
2026-01-11 00:00	#240	completed	Biased
2026-01-10 00:00	#237	completed	Biased
2026-01-09 00:34	#234	completed	Biased
2026-01-08 00:53	#231	completed	Biased
2026-01-06 18:15	#225	cancelled	Clean
2025-09-16 00:00	#113	completed	Clean
2025-09-15 00:00	#112	completed	Clean
2025-09-14 00:00	#111	completed	Clean
2025-09-13 00:00	#110	completed	Clean
2025-09-12 00:00	#109	completed	Clean
2025-09-11 00:00	#108	completed	Clean
2025-09-10 00:00	#107	completed	Clean
2025-08-17 00:01	#83	cancelled	Clean
2025-07-13 21:37	#48	completed	Clean
2025-07-12 23:44	#41	cancelled	Biased

Flagged Code Snippets

Get-AzDenyAssignment

Principals              : {
                          DisplayName:  All Principals
                          ObjectType:   SystemDefined
                          ObjectId:     00000000-0000-0000-0000-000000000000
                          }

Get-AzDenyAssignment -ResourceGroupName <resource_group_name>

PS C:\> Get-AzDenyAssignment
Id                      : /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storef2dfaqv5dzzfy/providers/Microsoft.Authorization/denyAssignments/6d266d71-a890-53b7-b0d8-2af6769ac019
DenyAssignmentName      : Deny assignment '6d266d71-a890-53b7-b0d8-2af6769ac019' created by Deployment Stack '/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack'.
Description             : Created by Deployment Stack '/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack'.
Actions                 : {*/delete}
NotActions              : {Microsoft.Authorization/locks/delete, Microsoft.Storage/storageAccounts/delete}
DataActions             : {}
NotDataActions          : {}
Scope                   : /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storef2dfaqv5dzzfy
DoNotApplyToChildScopes : True
Principals              : {
                          DisplayName:  All Principals
                          ObjectType:   SystemDefined
                          ObjectId:     00000000-0000-0000-0000-000000000000
                          }
ExcludePrincipals       : {
                          DisplayName:  User1
                          ObjectType:   User
                          ObjectId:     675986ff-5b6a-448c-9a22-fd2a65100221
                          }
IsSystemProtected       : True

Id                      : /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetf2dfaqv5dzzfy/providers/Microsoft.Authorization/denyAssignments/36a162b5-ddcc-529a-9deb-673250f90ba7
DenyAssignmentName      : Deny assignment '36a162b5-ddcc-529a-9deb-673250f90ba7' created by Deployment Stack '/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack'.
Description             : Created by Deployment Stack '/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack'.
Actions                 : {*/delete}
NotActions              : {Microsoft.Authorization/locks/delete, Microsoft.Storage/storageAccounts/delete}
DataActions             : {}
NotDataActions          : {}
Scope                   : /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetf2dfaqv5dzzfy
DoNotApplyToChildScopes : True
Principals              : {
                          DisplayName:  All Principals
                          ObjectType:   SystemDefined
                          ObjectId:     00000000-0000-0000-0000-000000000000
                          }
ExcludePrincipals       : {
                          DisplayName:  User1
                          ObjectType:   User
                          ObjectId:     675986ff-5b6a-448c-9a22-fd2a65100221
                          }
IsSystemProtected       : True

Get-AzDenyAssignment -Scope /subscriptions/<subscription_id>