Live Role Verification
Query Azure to confirm that provisioned RBAC role assignments are correct and sufficient for the application to function. This complements the static role check in azure-validate by validating live Azure state.
How It Differs from azure-validate's Role Check
| Check | Skill | What It Verifies |
|---|---|---|
| Static | azure-validate | Generated Bicep/Terraform has correct role assignments in code |
| Live | azure-deploy (this) | Provisioned Azure resources actually have the right roles assigned |
Both checks are needed because:
- Bicep may be correct but provisioning could fail silently for roles
- Manual changes or policy enforcement may alter role assignments
- Previous deployments may have stale or conflicting roles
When to Run
After deployment verification (step 7). Resources are now provisioned, so live role assignments can be queried.
Verification Steps
1. Identify App Identities
Read .azure/deployment-plan.md to find all services with managed identities. Then query Azure for their principal IDs:
bash
# App Service