Verifying the role assignments of a system-managed policy identity requires case changes

[cgordoncarroll]

Describe the bug

There is an outstanding bug in the Azure Policy Assignment API Here: Azure/azure-powershell#10196

This requires a user to manually assign permissions to a system-generated identity via a workaround (either Powershell or AZ Cli). When I retrieve the roleDefinitionIds from a policy definition to ensure that the workaround was successful, I have to change microsoft.authorization in the role identifier in order for the az role assignment list command to work.

Command Name
az policy definition show and az role assignment list

Errors:
Returns an empty list of role assignments erroneously.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az policy definition show --name <name> --scope <scope>
  Take the roleDefinitionIDs from policyRule.then.details.roleDefinitionId.

• az role assignment list --assignee <uuid> --scope /subscriptions/<sub_id> --role /subscriptions/<sub_id>/providers/microsoft.authorization/roleDefinitions/<role_id>

• Returns : []

• Change microsoft.authorization to Microsoft.Authorization

• az role assignment list --assignee <uuid> --scope /subscriptions/<sub_id> --role /subscriptions/<sub_id>/providers/Microsoft.Authorization/roleDefinitions/<role_id>

• Returns: [{<role_assignment_object>}

Expected Behavior

That the role definition returned by an azure CLI call can be used in a subsequent azure CLI call without the need for transformation.

Environment Summary

macOS-10.15.5-x86_64-i386-64bit
Python 3.8.3
Installer: HOMEBREW

azure-cli 2.6.0 *

Additional Context

[yonzhan]

add to S172