How to check permissions assigned to Managed Identity Access Token?

What if the token of managed identity doesn't have access on the automation account? In my case, there's no suitable IAM role on the RG that contains the automation account therefore I can't fetch its details.

Given that, I don't have access to the automation account means I can't fetch the object ID and therefore can't see roles. Is there any alternate approach?

HI @Najam ul Saqib,
Thanks for the response back

Why the Managed Identity Doesn't Need Access to the Automation Account Itself

 The system-assigned managed identity (MI) is automatically created and managed for the Azure Automation Account.

 Its purpose is to access other Azure resources (e.g., Key Vault, Storage, etc.) — it doesn't need permissions on the Automation Account itself to function.

 In my case, there's no suitable IAM role on the RG that contains the automation account therefore I can't fetch its details.

 What you’re trying to do is introspect its own identity (object ID) and check what permissions it has elsewhere, which is reasonable.

 Given that, I don't have access to the automation account means I can't fetch the object ID and therefore can't see roles.

 It fails only if the MI (or user) executing that code doesn't have Reader or higher permission on that resource group or subscription

 So yes — if you're inside the runbook and the MI doesn't have Reader access on the Automation Account’s RG, then it can't retrieve its own object ID that way.

 A custom role can be created if you want very granular access for specific resource actions.

Reference;

https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Given that, I don't have access to the automation account means I can't fetch the object ID and therefore can't see roles.

 Reader access on subscription or resource group level is sufficient to fetch the object ID of managed identity.

 To view the Permissions (Role Assignments) of a Managed Identity:

 You can only see role assignments:

 Within the scopes where you yourself have at least "Reader" access

 Azure will not show role assignments outside your permission boundary, even if you're querying for a valid Object ID

Please let me know if you face any challenge here, I can help you to resolve this issue further

Provide your valuable Comments.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

HI @Najam ul Saqib,

Just want to check if the above answer worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.