Skip to content

Commit 031933c

Browse files
rolyonrolyon
committed
Azure Resource Bridge Deployment Role and providers
1 parent bcec54c commit 031933c

File tree

5 files changed

+242
-129
lines changed

5 files changed

+242
-129
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -397,7 +397,6 @@ The following table provides a brief description of each built-in role. Click th
397397
> | <a name='azure-connected-machine-onboarding'></a>[Azure Connected Machine Onboarding](./built-in-roles/management-and-governance.md#azure-connected-machine-onboarding) | Can onboard Azure Connected Machines. | b64e21ea-ac4e-4cdf-9dc9-5b892992bee7 |
398398
> | <a name='azure-connected-machine-resource-administrator'></a>[Azure Connected Machine Resource Administrator](./built-in-roles/management-and-governance.md#azure-connected-machine-resource-administrator) | Can read, write, delete and re-onboard Azure Connected Machines. | cd570a14-e51a-42ad-bac8-bafd67325302 |
399399
> | <a name='azure-connected-machine-resource-manager'></a>[Azure Connected Machine Resource Manager](./built-in-roles/management-and-governance.md#azure-connected-machine-resource-manager) | Custom Role for AzureStackHCI RP to manage hybrid compute machines and hybrid connectivity endpoints in a resource group | f5819b54-e033-4d82-ac66-4fec3cbf3f4c |
400-
> | <a name='azure-resource-bridge-deployment-role'></a>[Azure Resource Bridge Deployment Role](./built-in-roles/management-and-governance.md#azure-resource-bridge-deployment-role) | Azure Resource Bridge Deployment Role | 7b1f81f9-4196-4058-8aae-762e593270df |
401400
> | <a name='billing-reader'></a>[Billing Reader](./built-in-roles/management-and-governance.md#billing-reader) | Allows read access to billing data | fa23ad8b-c56e-40d8-ac0c-ce449e1d2c64 |
402401
> | <a name='blueprint-contributor'></a>[Blueprint Contributor](./built-in-roles/management-and-governance.md#blueprint-contributor) | Can manage blueprint definitions, but not assign them. | 41077137-e803-4205-871c-5a86e6a753b4 |
403402
> | <a name='blueprint-operator'></a>[Blueprint Operator](./built-in-roles/management-and-governance.md#blueprint-operator) | Can assign existing published blueprints, but cannot create new blueprints. Note that this only works if the assignment is done with a user-assigned managed identity. | 437d2ced-4a38-4302-8479-ed2bcb43d090 |
@@ -430,6 +429,7 @@ The following table provides a brief description of each built-in role. Click th
430429
> [!div class="mx-tableFixed"]
431430
> | Built-in role | Description | ID |
432431
> | --- | --- | --- |
432+
> | <a name='azure-resource-bridge-deployment-role'></a>[Azure Resource Bridge Deployment Role](./built-in-roles/hybrid-multicloud.md#azure-resource-bridge-deployment-role) | Azure Resource Bridge Deployment Role | 7b1f81f9-4196-4058-8aae-762e593270df |
433433
> | <a name='azure-stack-hci-administrator'></a>[Azure Stack HCI Administrator](./built-in-roles/hybrid-multicloud.md#azure-stack-hci-administrator) | Grants full access to the cluster and its resources, including the ability to register Azure Stack HCI and assign others as Azure Arc HCI VM Contributor and/or Azure Arc HCI VM Reader | bda0d508-adf1-4af0-9c28-88919fc3ae06 |
434434
> | <a name='azure-stack-hci-device-management-role'></a>[Azure Stack HCI Device Management Role](./built-in-roles/hybrid-multicloud.md#azure-stack-hci-device-management-role) | Microsoft.AzureStackHCI Device Management Role | 865ae368-6a45-4bd1-8fbf-0d5151f56fc1 |
435435
> | <a name='azure-stack-hci-vm-contributor'></a>[Azure Stack HCI VM Contributor](./built-in-roles/hybrid-multicloud.md#azure-stack-hci-vm-contributor) | Grants permissions to perform all VM actions | 874d1c73-6003-4e60-a13a-cb31ea190a85 |

‎articles/role-based-access-control/built-in-roles/hybrid-multicloud.md

Lines changed: 128 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,117 @@ ms.custom: generated
1616
This article lists the Azure built-in roles in the Hybrid + multicloud category.
1717

1818

19+
## Azure Resource Bridge Deployment Role
20+
21+
Azure Resource Bridge Deployment Role
22+
23+
[Learn more](/azure-stack/hci/deploy/deployment-azure-resource-manager-template)
24+
25+
> [!div class="mx-tableFixed"]
26+
> | Actions | Description |
27+
> | --- | --- |
28+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleassignments/read | Get information about a role assignment. |
29+
> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/Register/Action | Registers the subscription for the Azure Stack HCI resource provider and enables the creation of Azure Stack HCI resources. |
30+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/register/action | Registers the subscription for Appliances resource provider and enables the creation of Appliance. |
31+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/read | Gets an Appliance resource |
32+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/write | Creates or Updates Appliance resource |
33+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/delete | Deletes Appliance resource |
34+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/locations/operationresults/read | Get result of Appliance operation |
35+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/locations/operationsstatus/read | Get result of Appliance operation |
36+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/listClusterUserCredential/action | Get an appliance cluster user credential |
37+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/listKeys/action | Get an appliance cluster customer user keys |
38+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/upgradeGraphs/read | Gets the upgrade graph of Appliance cluster |
39+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/telemetryconfig/read | Get Appliances telemetry config utilized by Appliances CLI |
40+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/operations/read | Gets list of Available Operations for Appliances |
41+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/register/action | Registers the subscription for Custom Location resource provider and enables the creation of Custom Location. |
42+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
43+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/read | Gets an Custom Location resource |
44+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/write | Creates or Updates Custom Location resource |
45+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/delete | Deletes Custom Location resource |
46+
> | [Microsoft.HybridConnectivity](../permissions/hybrid-multicloud.md#microsofthybridconnectivity)/register/action | Register the subscription for Microsoft.HybridConnectivity |
47+
> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/register/action | Registers Subscription with Microsoft.Kubernetes resource provider |
48+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/register/action | Registers subscription to Microsoft.KubernetesConfiguration resource provider. |
49+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/write | Creates or updates extension resource. |
50+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |
51+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/delete | Deletes extension instance resource. |
52+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/operations/read | Gets Async Operation status. |
53+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/namespaces/read | Get Namespace Resource |
54+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/operations/read | Gets available operations of the Microsoft.KubernetesConfiguration resource provider. |
55+
> | [Microsoft.GuestConfiguration](../permissions/management-and-governance.md#microsoftguestconfiguration)/guestConfigurationAssignments/read | Get guest configuration assignment. |
56+
> | [Microsoft.HybridContainerService](../permissions/hybrid-multicloud.md#microsofthybridcontainerservice)/register/action | Register the subscription for Microsoft.HybridContainerService |
57+
> | [Microsoft.HybridContainerService](../permissions/hybrid-multicloud.md#microsofthybridcontainerservice)/kubernetesVersions/read | Lists the supported kubernetes versions from the underlying custom location |
58+
> | [Microsoft.HybridContainerService](../permissions/hybrid-multicloud.md#microsofthybridcontainerservice)/kubernetesVersions/write | Puts the kubernetes version resource type |
59+
> | [Microsoft.HybridContainerService](../permissions/hybrid-multicloud.md#microsofthybridcontainerservice)/skus/read | Lists the supported VM SKUs from the underlying custom location |
60+
> | [Microsoft.HybridContainerService](../permissions/hybrid-multicloud.md#microsofthybridcontainerservice)/skus/write | Puts the VM SKUs resource type |
61+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
62+
> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/StorageContainers/Write | Creates/Updates storage containers resource |
63+
> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/StorageContainers/Read | Gets/Lists storage containers resource |
64+
> | **NotActions** | |
65+
> | *none* | |
66+
> | **DataActions** | |
67+
> | *none* | |
68+
> | **NotDataActions** | |
69+
> | *none* | |
70+
71+
```json
72+
{
73+
"assignableScopes": [
74+
"/"
75+
],
76+
"description": "Azure Resource Bridge Deployment Role",
77+
"id": "/providers/Microsoft.Authorization/roleDefinitions/7b1f81f9-4196-4058-8aae-762e593270df",
78+
"name": "7b1f81f9-4196-4058-8aae-762e593270df",
79+
"permissions": [
80+
{
81+
"actions": [
82+
"Microsoft.Authorization/roleassignments/read",
83+
"Microsoft.AzureStackHCI/Register/Action",
84+
"Microsoft.ResourceConnector/register/action",
85+
"Microsoft.ResourceConnector/appliances/read",
86+
"Microsoft.ResourceConnector/appliances/write",
87+
"Microsoft.ResourceConnector/appliances/delete",
88+
"Microsoft.ResourceConnector/locations/operationresults/read",
89+
"Microsoft.ResourceConnector/locations/operationsstatus/read",
90+
"Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
91+
"Microsoft.ResourceConnector/appliances/listKeys/action",
92+
"Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
93+
"Microsoft.ResourceConnector/telemetryconfig/read",
94+
"Microsoft.ResourceConnector/operations/read",
95+
"Microsoft.ExtendedLocation/register/action",
96+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
97+
"Microsoft.ExtendedLocation/customLocations/read",
98+
"Microsoft.ExtendedLocation/customLocations/write",
99+
"Microsoft.ExtendedLocation/customLocations/delete",
100+
"Microsoft.HybridConnectivity/register/action",
101+
"Microsoft.Kubernetes/register/action",
102+
"Microsoft.KubernetesConfiguration/register/action",
103+
"Microsoft.KubernetesConfiguration/extensions/write",
104+
"Microsoft.KubernetesConfiguration/extensions/read",
105+
"Microsoft.KubernetesConfiguration/extensions/delete",
106+
"Microsoft.KubernetesConfiguration/extensions/operations/read",
107+
"Microsoft.KubernetesConfiguration/namespaces/read",
108+
"Microsoft.KubernetesConfiguration/operations/read",
109+
"Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
110+
"Microsoft.HybridContainerService/register/action",
111+
"Microsoft.HybridContainerService/kubernetesVersions/read",
112+
"Microsoft.HybridContainerService/kubernetesVersions/write",
113+
"Microsoft.HybridContainerService/skus/read",
114+
"Microsoft.HybridContainerService/skus/write",
115+
"Microsoft.Resources/subscriptions/resourceGroups/read",
116+
"Microsoft.AzureStackHCI/StorageContainers/Write",
117+
"Microsoft.AzureStackHCI/StorageContainers/Read"
118+
],
119+
"notActions": [],
120+
"dataActions": [],
121+
"notDataActions": []
122+
}
123+
],
124+
"roleName": "Azure Resource Bridge Deployment Role",
125+
"roleType": "BuiltInRole",
126+
"type": "Microsoft.Authorization/roleDefinitions"
127+
}
128+
```
129+
19130
## Azure Stack HCI Administrator
20131

21132
Grants full access to the cluster and its resources, including the ability to register Azure Stack HCI and assign others as Azure Arc HCI VM Contributor and/or Azure Arc HCI VM Reader
@@ -86,20 +197,20 @@ Grants full access to the cluster and its resources, including the ability to re
86197
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |
87198
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |
88199
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |
89-
> | Microsoft.ResourceConnector/register/action | Registers the subscription for Appliances resource provider and enables the creation of Appliance. |
90-
> | Microsoft.ResourceConnector/appliances/read | Gets an Appliance resource |
91-
> | Microsoft.ResourceConnector/appliances/write | Creates or Updates Appliance resource |
92-
> | Microsoft.ResourceConnector/appliances/delete | Deletes Appliance resource |
93-
> | Microsoft.ResourceConnector/locations/operationresults/read | Get result of Appliance operation |
94-
> | Microsoft.ResourceConnector/locations/operationsstatus/read | Get result of Appliance operation |
95-
> | Microsoft.ResourceConnector/appliances/listClusterUserCredential/action | Get an appliance cluster user credential |
96-
> | Microsoft.ResourceConnector/appliances/listKeys/action | Get an appliance cluster customer user keys |
97-
> | Microsoft.ResourceConnector/operations/read | Gets list of Available Operations for Appliances |
98-
> | Microsoft.ExtendedLocation/register/action | Registers the subscription for Custom Location resource provider and enables the creation of Custom Location. |
99-
> | Microsoft.ExtendedLocation/customLocations/read | Gets an Custom Location resource |
100-
> | Microsoft.ExtendedLocation/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
101-
> | Microsoft.ExtendedLocation/customLocations/write | Creates or Updates Custom Location resource |
102-
> | Microsoft.ExtendedLocation/customLocations/delete | Deletes Custom Location resource |
200+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/register/action | Registers the subscription for Appliances resource provider and enables the creation of Appliance. |
201+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/read | Gets an Appliance resource |
202+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/write | Creates or Updates Appliance resource |
203+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/delete | Deletes Appliance resource |
204+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/locations/operationresults/read | Get result of Appliance operation |
205+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/locations/operationsstatus/read | Get result of Appliance operation |
206+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/listClusterUserCredential/action | Get an appliance cluster user credential |
207+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/listKeys/action | Get an appliance cluster customer user keys |
208+
> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/operations/read | Gets list of Available Operations for Appliances |
209+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/register/action | Registers the subscription for Custom Location resource provider and enables the creation of Custom Location. |
210+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/read | Gets an Custom Location resource |
211+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
212+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/write | Creates or Updates Custom Location resource |
213+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/delete | Deletes Custom Location resource |
103214
> | Microsoft.EdgeMarketplace/offers/read | Get a Offer |
104215
> | Microsoft.EdgeMarketplace/publishers/read | Get a Publisher |
105216
> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/register/action | Registers Subscription with Microsoft.Kubernetes resource provider |
@@ -113,7 +224,7 @@ Grants full access to the cluster and its resources, including the ability to re
113224
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
114225
> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/StorageContainers/Write | Creates/Updates storage containers resource |
115226
> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/StorageContainers/Read | Gets/Lists storage containers resource |
116-
> | Microsoft.HybridContainerService/register/action | Register the subscription for Microsoft.HybridContainerService |
227+
> | [Microsoft.HybridContainerService](../permissions/hybrid-multicloud.md#microsofthybridcontainerservice)/register/action | Register the subscription for Microsoft.HybridContainerService |
117228
> | **NotActions** | |
118229
> | *none* | |
119230
> | **DataActions** | |
@@ -361,8 +472,8 @@ Grants permissions to perform all VM actions
361472
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |
362473
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |
363474
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |
364-
> | Microsoft.ExtendedLocation/customLocations/Read | Gets an Custom Location resource |
365-
> | Microsoft.ExtendedLocation/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
475+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/Read | Gets an Custom Location resource |
476+
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
366477
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |
367478
> | **NotActions** | |
368479
> | *none* | |

0 commit comments

Comments
 (0)