---
title: "GET /{denyAssignmentId}"
method: GET
path: "/{denyAssignmentId}"
tags: ["DenyAssignments"]
---

# GET /{denyAssignmentId}

`GET /{denyAssignmentId}`

Gets a deny assignment by ID.

## Path parameters

- `denyAssignmentId` string, required

## Parameters

- `../../../../../common-types/resource-management/v2/types.json#/components/parameters/ApiVersionParameter` — unresolved $ref

## Response `200`

OK - Returns the deny assignment.

- DenyAssignment — Deny Assignment
  - `id` string — The deny assignment ID.
  - `name` string — The deny assignment name.
  - `type` string — The deny assignment type.
  - `properties` DenyAssignmentProperties — Deny assignment properties.
    - `denyAssignmentName` string — The display name of the deny assignment.
    - `description` string — The description of the deny assignment.
    - `permissions` DenyAssignmentPermission[] — An array of permissions that are denied by the deny assignment.
      - `actions` string[] — Actions to which the deny assignment does not grant access.
      - `notActions` string[] — Actions to exclude from that the deny assignment does not grant access.
      - `dataActions` string[] — Data actions to which the deny assignment does not grant access.
      - `notDataActions` string[] — Data actions to exclude from that the deny assignment does not grant access.
    - `scope` string — The deny assignment scope.
    - `doNotApplyToChildScopes` boolean — Determines if the deny assignment applies to child scopes. Default value is false.
    - `principals` Principal[] — Array of principals to which the deny assignment applies.
      - `id` string — Object ID of the Azure AD principal (user, group, or service principal) to which the deny assignment applies. An empty guid '00000000-0000-0000-0000-000000000000' as principal id and principal type as 'Everyone' represents all users, groups and service principals.
      - `type` string — Type of object represented by principal id (user, group, or service principal). An empty guid '00000000-0000-0000-0000-000000000000' as principal id and principal type as 'Everyone' represents all users, groups and service principals.
    - `excludePrincipals` Principal[] — Array of principals to which the deny assignment does not apply.
      - `id` string — Object ID of the Azure AD principal (user, group, or service principal) to which the deny assignment applies. An empty guid '00000000-0000-0000-0000-000000000000' as principal id and principal type as 'Everyone' represents all users, groups and service principals.
      - `type` string — Type of object represented by principal id (user, group, or service principal). An empty guid '00000000-0000-0000-0000-000000000000' as principal id and principal type as 'Everyone' represents all users, groups and service principals.
    - `isSystemProtected` boolean — Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.

## Other responses

- `default` — Error response describing why the operation failed.

## Changes

- **2021-02-21** (2018-07-01-preview) `9bd884b8dc22` — 1 warning
  - deleted the `query` request parameter `api-version`

[Change history](https://skmtc.dev/azure/apis/authorizationmanagementclient-2/changes/:denyAssignmentId/get.md)

---

[API](https://skmtc.dev/azure/apis/authorizationmanagementclient-2.md) · [All operations](https://skmtc.dev/azure/apis/authorizationmanagementclient-2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azure/authorizationmanagementclient-2/revisions/9bd884b8dc22/schema)