Legacy Administration

def list() -> Iterator[ClassicAdministrator]:
    """
    List classic administrators for the subscription.
    
    Returns:
    Iterator of ClassicAdministrator objects representing legacy administrators
    """

def elevate_access() -> None:
    """
    Elevate access for the Global Administrator to manage all Azure subscriptions
    and management groups in the tenant. This operation grants the Global Administrator
    User Access Administrator role at the root scope.
    
    Note: This is a privileged operation that should be used carefully and only
    when necessary for tenant-wide administration.
    """

from azure.mgmt.authorization import AuthorizationManagementClient
from azure.identity import DefaultAzureCredential

# Initialize client
credential = DefaultAzureCredential()
client = AuthorizationManagementClient(
    credential=credential,
    subscription_id="your-subscription-id"
)

# List classic administrators
classic_admins = client.classic_administrators.list()

print("Classic Administrators:")
for admin in classic_admins:
    print(f"Email: {admin.email_address}")
    print(f"Role: {admin.role}")
    print(f"Type: {admin.type}")
    print("---")

# This operation requires Global Administrator privileges in Azure AD
try:
    # Elevate access for Global Administrator
    client.global_administrator.elevate_access()
    print("Global Administrator access elevated successfully")
    print("User Access Administrator role granted at root scope")
    
except Exception as e:
    print(f"Failed to elevate access: {e}")
    # Common reasons for failure:
    # - Not a Global Administrator
    # - Already have elevated access
    # - Tenant policies prevent elevation

# Check classic administrators
classic_admins = list(client.classic_administrators.list())
print(f"Classic administrators count: {len(classic_admins)}")

# Check modern RBAC administrators at subscription level
rbac_admins = client.role_assignments.list_for_subscription(
    filter="roleDefinitionId eq '/subscriptions/{}/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635'".format(
        "your-subscription-id"  # Owner role
    )
)

print("Modern RBAC Owners:")
for assignment in rbac_admins:
    print(f"Principal: {assignment.principal_id}")
    print(f"Scope: {assignment.scope}")

class ClassicAdministrator:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    email_address: Optional[str]
    role: Optional[str]  # "ServiceAdministrator" or "CoAdministrator"

class ClassicAdministratorProperties:
    email_address: Optional[str]
    role: Optional[str]

class ClassicAdministratorRole:
    SERVICE_ADMINISTRATOR = "ServiceAdministrator"
    CO_ADMINISTRATOR = "CoAdministrator"

class ClassicAdministratorType:
    CLASSIC_SUBSCRIPTION_ADMINISTRATOR = "Microsoft.Authorization/classicAdministrators"

# Example migration: Convert classic admin to modern RBAC
from azure.mgmt.authorization.models import RoleAssignmentCreateParameters

# List classic administrators to migrate
classic_admins = list(client.classic_administrators.list())

for admin in classic_admins:
    if admin.role == "CoAdministrator":
        # Create equivalent RBAC assignment
        assignment_params = RoleAssignmentCreateParameters(
            role_definition_id="/subscriptions/{}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c".format(
                subscription_id  # Contributor role
            ),
            principal_id="user-object-id-for-" + admin.email_address,
            principal_type="User"
        )
        
        client.role_assignments.create(
            scope=f"/subscriptions/{subscription_id}",
            role_assignment_name="migration-assignment-guid",
            parameters=assignment_params
        )
        
        print(f"Migrated {admin.email_address} from Co-Administrator to Contributor")

from azure.core.exceptions import ForbiddenError, BadRequestError

try:
    client.global_administrator.elevate_access()
except ForbiddenError:
    print("Access denied - requires Global Administrator role")
except BadRequestError:
    print("Bad request - may already have elevated access")

try:
    classic_admins = list(client.classic_administrators.list())
except ForbiddenError:
    print("Insufficient permissions to list classic administrators")