Reverted multiple-scope due to complexity introduced. Added ability to restrict assignments to ServicePrincipal only.

outputs.tf

@@ -1,14 +1,14 @@
 output "role_assignment_ids" {
-  value       = { for key, ra in azurerm_role_assignment.role : key => ra.id }
-  description = "IDs of unconditional role assignments, keyed by '${scope}:${role_definition_name}'."
+  value       = { for role, ra in azurerm_role_assignment.role : role => ra.id }
+  description = "IDs of unconditional role assignments, keyed by role definition name."
 }
 
 output "rbac_admin_role_assignment_id" {
-  value       = { for scope, ra in azurerm_role_assignment.rbac_admin : scope => ra.id }
-  description = "IDs of constrained RBAC Administrator role assignments, keyed by scope. Empty when delegable_roles is empty."
+  value       = length(azurerm_role_assignment.rbac_admin) > 0 ? azurerm_role_assignment.rbac_admin["this"].id : null
+  description = "ID of the constrained RBAC Administrator role assignment, or null when delegable_roles is empty."
 }
 
 output "rbac_admin_condition" {
   value       = length(var.delegable_roles) > 0 ? local.rbac_admin_condition : null
-  description = "Rendered condition used for constrained RBAC Administrator assignments, or null when delegable_roles is empty."
+  description = "Rendered condition used for constrained RBAC Administrator assignment, or null when delegable_roles is empty."
 }