Skip to content

Commit 04db7b7

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #286507 from rolyon/rolyon-rbac-roles-deid-healthdataaiservices
[Azure RBAC] DeID roles and HealthDataAIServices provider
2 parents ea32228 + 75fa999 commit 04db7b7

File tree

4 files changed

+210
-0
lines changed

4 files changed

+210
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,10 @@ The following table provides a brief description of each built-in role. Click th
303303
> | <a name='azure-service-bus-data-receiver'></a>[Azure Service Bus Data Receiver](./built-in-roles/integration.md#azure-service-bus-data-receiver) | Allows for receive access to Azure Service Bus resources. | 4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0 |
304304
> | <a name='azure-service-bus-data-sender'></a>[Azure Service Bus Data Sender](./built-in-roles/integration.md#azure-service-bus-data-sender) | Allows for send access to Azure Service Bus resources. | 69a216fc-b8fb-44d8-bc22-1f3c2cd27a39 |
305305
> | <a name='biztalk-contributor'></a>[BizTalk Contributor](./built-in-roles/integration.md#biztalk-contributor) | Lets you manage BizTalk services, but not access to them. | 5e3c6656-6cfa-4708-81fe-0de47ac73342 |
306+
> | <a name='deid-batch-data-owner'></a>[DeID Batch Data Owner](./built-in-roles/integration.md#deid-batch-data-owner) | Create and manage DeID batch jobs. This role is in preview and subject to change. | 8a90fa6b-6997-4a07-8a95-30633a7c97b9 |
307+
> | <a name='deid-batch-data-reader'></a>[DeID Batch Data Reader](./built-in-roles/integration.md#deid-batch-data-reader) | Read DeID batch jobs. This role is in preview and subject to change. | b73a14ee-91f5-41b7-bd81-920e12466be9 |
308+
> | <a name='deid-data-owner'></a>[DeID Data Owner](./built-in-roles/integration.md#deid-data-owner) | Full access to DeID data. This role is in preview and subject to change | 78e4b983-1a0b-472e-8b7d-8d770f7c5890 |
309+
> | <a name='deid-realtime-data-user'></a>[DeID Realtime Data User](./built-in-roles/integration.md#deid-realtime-data-user) | Execute requests against DeID realtime endpoint. This role is in preview and subject to change. | bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e |
306310
> | <a name='eventgrid-contributor'></a>[EventGrid Contributor](./built-in-roles/integration.md#eventgrid-contributor) | Lets you manage EventGrid operations. | 1e241071-0855-49ea-94dc-649edcd759de |
307311
> | <a name='eventgrid-data-sender'></a>[EventGrid Data Sender](./built-in-roles/integration.md#eventgrid-data-sender) | Allows send access to event grid events. | d5a91429-5739-47e2-a06b-3470a27159e7 |
308312
> | <a name='eventgrid-eventsubscription-contributor'></a>[EventGrid EventSubscription Contributor](./built-in-roles/integration.md#eventgrid-eventsubscription-contributor) | Lets you manage EventGrid event subscription operations. | 428e0ff0-5e57-4d9c-a221-2c70d0e0a443 |

‎articles/role-based-access-control/built-in-roles/integration.md

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1102,6 +1102,178 @@ Lets you manage BizTalk services, but not access to them.
11021102
}
11031103
```
11041104

1105+
## DeID Batch Data Owner
1106+
1107+
Create and manage DeID batch jobs. This role is in preview and subject to change.
1108+
1109+
[Learn more](/azure/healthcare-apis/deidentification/manage-access-rbac)
1110+
1111+
> [!div class="mx-tableFixed"]
1112+
> | Actions | Description |
1113+
> | --- | --- |
1114+
> | *none* | |
1115+
> | **NotActions** | |
1116+
> | *none* | |
1117+
> | **DataActions** | |
1118+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Batch/write | Creates batches |
1119+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Batch/delete | Deletes a batch |
1120+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Batch/read | Reads a batch |
1121+
> | **NotDataActions** | |
1122+
> | *none* | |
1123+
1124+
```json
1125+
{
1126+
"assignableScopes": [
1127+
"/"
1128+
],
1129+
"description": "Create and manage DeID batch jobs. This role is in preview and subject to change.",
1130+
"id": "/providers/Microsoft.Authorization/roleDefinitions/8a90fa6b-6997-4a07-8a95-30633a7c97b9",
1131+
"name": "8a90fa6b-6997-4a07-8a95-30633a7c97b9",
1132+
"permissions": [
1133+
{
1134+
"actions": [],
1135+
"notActions": [],
1136+
"dataActions": [
1137+
"Microsoft.HealthDataAIServices/DeidServices/Batch/write",
1138+
"Microsoft.HealthDataAIServices/DeidServices/Batch/delete",
1139+
"Microsoft.HealthDataAIServices/DeidServices/Batch/read"
1140+
],
1141+
"notDataActions": []
1142+
}
1143+
],
1144+
"roleName": "DeID Batch Data Owner",
1145+
"roleType": "BuiltInRole",
1146+
"type": "Microsoft.Authorization/roleDefinitions"
1147+
}
1148+
```
1149+
1150+
## DeID Batch Data Reader
1151+
1152+
Read DeID batch jobs. This role is in preview and subject to change.
1153+
1154+
[Learn more](/azure/healthcare-apis/deidentification/manage-access-rbac)
1155+
1156+
> [!div class="mx-tableFixed"]
1157+
> | Actions | Description |
1158+
> | --- | --- |
1159+
> | *none* | |
1160+
> | **NotActions** | |
1161+
> | *none* | |
1162+
> | **DataActions** | |
1163+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Batch/read | Reads a batch |
1164+
> | **NotDataActions** | |
1165+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Batch/write | Creates batches |
1166+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Batch/delete | Deletes a batch |
1167+
1168+
```json
1169+
{
1170+
"assignableScopes": [
1171+
"/"
1172+
],
1173+
"description": "Read DeID batch jobs. This role is in preview and subject to change.",
1174+
"id": "/providers/Microsoft.Authorization/roleDefinitions/b73a14ee-91f5-41b7-bd81-920e12466be9",
1175+
"name": "b73a14ee-91f5-41b7-bd81-920e12466be9",
1176+
"permissions": [
1177+
{
1178+
"actions": [],
1179+
"notActions": [],
1180+
"dataActions": [
1181+
"Microsoft.HealthDataAIServices/DeidServices/Batch/read"
1182+
],
1183+
"notDataActions": [
1184+
"Microsoft.HealthDataAIServices/DeidServices/Batch/write",
1185+
"Microsoft.HealthDataAIServices/DeidServices/Batch/delete"
1186+
]
1187+
}
1188+
],
1189+
"roleName": "DeID Batch Data Reader",
1190+
"roleType": "BuiltInRole",
1191+
"type": "Microsoft.Authorization/roleDefinitions"
1192+
}
1193+
```
1194+
1195+
## DeID Data Owner
1196+
1197+
Full access to DeID data. This role is in preview and subject to change
1198+
1199+
[Learn more](/azure/healthcare-apis/deidentification/manage-access-rbac)
1200+
1201+
> [!div class="mx-tableFixed"]
1202+
> | Actions | Description |
1203+
> | --- | --- |
1204+
> | *none* | |
1205+
> | **NotActions** | |
1206+
> | *none* | |
1207+
> | **DataActions** | |
1208+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/* | |
1209+
> | **NotDataActions** | |
1210+
> | *none* | |
1211+
1212+
```json
1213+
{
1214+
"assignableScopes": [
1215+
"/"
1216+
],
1217+
"description": "Full access to DeID data. This role is in preview and subject to change",
1218+
"id": "/providers/Microsoft.Authorization/roleDefinitions/78e4b983-1a0b-472e-8b7d-8d770f7c5890",
1219+
"name": "78e4b983-1a0b-472e-8b7d-8d770f7c5890",
1220+
"permissions": [
1221+
{
1222+
"actions": [],
1223+
"notActions": [],
1224+
"dataActions": [
1225+
"Microsoft.HealthDataAIServices/DeidServices/*"
1226+
],
1227+
"notDataActions": []
1228+
}
1229+
],
1230+
"roleName": "DeID Data Owner",
1231+
"roleType": "BuiltInRole",
1232+
"type": "Microsoft.Authorization/roleDefinitions"
1233+
}
1234+
```
1235+
1236+
## DeID Realtime Data User
1237+
1238+
Execute requests against DeID realtime endpoint. This role is in preview and subject to change.
1239+
1240+
[Learn more](/azure/healthcare-apis/deidentification/manage-access-rbac)
1241+
1242+
> [!div class="mx-tableFixed"]
1243+
> | Actions | Description |
1244+
> | --- | --- |
1245+
> | *none* | |
1246+
> | **NotActions** | |
1247+
> | *none* | |
1248+
> | **DataActions** | |
1249+
> | [Microsoft.HealthDataAIServices](../permissions/integration.md#microsofthealthdataaiservices)/DeidServices/Realtime/action | Allows access to the realtime endpoint |
1250+
> | **NotDataActions** | |
1251+
> | *none* | |
1252+
1253+
```json
1254+
{
1255+
"assignableScopes": [
1256+
"/"
1257+
],
1258+
"description": "Execute requests against DeID realtime endpoint. This role is in preview and subject to change.",
1259+
"id": "/providers/Microsoft.Authorization/roleDefinitions/bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e",
1260+
"name": "bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e",
1261+
"permissions": [
1262+
{
1263+
"actions": [],
1264+
"notActions": [],
1265+
"dataActions": [
1266+
"Microsoft.HealthDataAIServices/DeidServices/Realtime/action"
1267+
],
1268+
"notDataActions": []
1269+
}
1270+
],
1271+
"roleName": "DeID Realtime Data User",
1272+
"roleType": "BuiltInRole",
1273+
"type": "Microsoft.Authorization/roleDefinitions"
1274+
}
1275+
```
1276+
11051277
## EventGrid Contributor
11061278

11071279
Lets you manage EventGrid operations.

‎articles/role-based-access-control/permissions/integration.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1100,6 +1100,39 @@ Azure service: [Azure API for FHIR](/azure/healthcare-apis/azure-api-for-fhir/)
11001100
> | Microsoft.HealthcareApis/workspaces/fhirservices/resources/editProfileDefinitions/action | Allows user to perform Create Update Delete operations on profile resources. |
11011101
> | Microsoft.HealthcareApis/workspaces/fhirservices/resources/searchParameter/action | Allows running of $status operation for Search Parameters |
11021102
1103+
## Microsoft.HealthDataAIServices
1104+
1105+
Azure service: [Azure Health Data Services](/azure/healthcare-apis/healthcare-apis-overview)
1106+
1107+
> [!div class="mx-tableFixed"]
1108+
> | Action | Description |
1109+
> | --- | --- |
1110+
> | Microsoft.HealthDataAIServices/register/action | Register the subscription for Microsoft.HealthDataAIServices |
1111+
> | Microsoft.HealthDataAIServices/unregister/action | Unregister the subscription for Microsoft.HealthDataAIServices |
1112+
> | Microsoft.HealthDataAIServices/DeidServices/read | List DeidService resources by subscription ID |
1113+
> | Microsoft.HealthDataAIServices/DeidServices/read | List DeidService resources by resource group |
1114+
> | Microsoft.HealthDataAIServices/DeidServices/read | Get a DeidService |
1115+
> | Microsoft.HealthDataAIServices/DeidServices/write | Create a DeidService |
1116+
> | Microsoft.HealthDataAIServices/DeidServices/delete | Delete a DeidService |
1117+
> | Microsoft.HealthDataAIServices/DeidServices/write | Update a DeidService |
1118+
> | Microsoft.HealthDataAIServices/locations/operationStatuses/read | read operationStatuses |
1119+
> | Microsoft.HealthDataAIServices/locations/operationStatuses/write | write operationStatuses |
1120+
> | Microsoft.HealthDataAIServices/Operations/read | read Operations |
1121+
> | **DataAction** | **Description** |
1122+
> | Microsoft.HealthDataAIServices/DeidServices/Realtime/action | Allows access to the realtime endpoint |
1123+
> | Microsoft.HealthDataAIServices/DeidServices/Batch/write | Creates batches |
1124+
> | Microsoft.HealthDataAIServices/DeidServices/Batch/delete | Deletes a batch |
1125+
> | Microsoft.HealthDataAIServices/DeidServices/Batch/read | Reads a batch |
1126+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnectionProxies/delete | Deletes private endpoint connection proxies |
1127+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnectionProxies/read | Reads private endpoint connection proxies |
1128+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnectionProxies/write | Writes private endpoint connection proxies |
1129+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnectionProxies/validate/action | Validates private endpoint connection proxies |
1130+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnectionProxies/validate/action | Validates private endpoint connection proxies |
1131+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnections/read | Reads private endpoint connections |
1132+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnections/write | Writes private endpoint connections |
1133+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateEndpointConnections/delete | Deletes private endpoint connections |
1134+
> | Microsoft.HealthDataAIServices/DeidServices/PrivateLinkResources/read | Reads private link resources |
1135+
11031136
## Microsoft.Logic
11041137

11051138
Automate the access and use of data across clouds without writing code.

‎articles/role-based-access-control/resource-provider-operations.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ Click the resource provider name in the following list to see the list of permis
186186
> | [Microsoft.EventGrid](./permissions/integration.md#microsofteventgrid) | Get reliable event delivery at massive scale. | [Event Grid](/azure/event-grid/) |
187187
> | [Microsoft.EventHub](./permissions/integration.md#microsofteventhub) | Receive telemetry from millions of devices. | [Event Hubs](/azure/event-hubs/) |
188188
> | [Microsoft.HealthcareApis](./permissions/integration.md#microsofthealthcareapis) | | [Azure API for FHIR](/azure/healthcare-apis/azure-api-for-fhir/) |
189+
> | [Microsoft.HealthDataAIServices](./permissions/integration.md#microsofthealthdataaiservices) | | [Azure Health Data Services](/azure/healthcare-apis/healthcare-apis-overview) |
189190
> | [Microsoft.Logic](./permissions/integration.md#microsoftlogic) | Automate the access and use of data across clouds without writing code. | [Logic Apps](/azure/logic-apps/) |
190191
> | [Microsoft.NotificationHubs](./permissions/integration.md#microsoftnotificationhubs) | Send push notifications to any platform from any back end. | [Notification Hubs](/azure/notification-hubs/) |
191192
> | [Microsoft.Relay](./permissions/integration.md#microsoftrelay) | Expose services that run in your corporate network to the public cloud. | [Azure Relay](/azure/azure-relay/relay-what-is-it) |

0 commit comments

Comments
 (0)