|
| 1 | +--- |
| 2 | +title: "Quickstart: Add users to Modeling and Simulation Workbench" |
| 3 | +description: "Add users to a Modeling and Simulation Workbench." |
| 4 | +author: yousefi-msft |
| 5 | +ms.author: yousefi |
| 6 | +ms.service: modeling-simulation-workbench |
| 7 | +ms.topic: quickstart |
| 8 | +ms.date: 09/25/2024 |
| 9 | + |
| 10 | +#customer intent: As a administrator, I want to add users so that they can begin using the Modeling and Simulation Workbench. |
| 11 | +--- |
| 12 | + |
| 13 | +# Quickstart: Add users to a chamber |
| 14 | + |
| 15 | +After you create your Modeling and Simulation Workbench, you'll need to add users and assign roles. In this quickstart, you'll learn how to add users a chamber as either a *Chamber Admin* or *Chamber User* along with the correct Microsoft Entra role assignments to enable them to do tasks. |
| 16 | + |
| 17 | +If you don't have a service subscription, [create a free |
| 18 | +trial account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). |
| 19 | + |
| 20 | +## Prerequisites |
| 21 | + |
| 22 | +[!INCLUDE [prerequisite-account-sub](includes/prerequisite-account-sub.md)] |
| 23 | + |
| 24 | +[!INCLUDE [prerequisite-mswb-chamber](includes/prerequisite-chamber.md)] |
| 25 | + |
| 26 | +* Users to be added to a chamber must already exist in your company's Microsoft Entra ID tenant. If you want to invite guests to collaborate in your chamber, you must add or invite them to your Microsoft Entra ID tenant. |
| 27 | + |
| 28 | +* Email fields in the user's Microsoft Entra ID user profile. The email alias must match exactly the user's Microsoft Entra sign-in alias. For example, a Microsoft Entra sign-in alias of < [email protected]> must also have the email alias of < [email protected]>. |
| 29 | + |
| 30 | +## Add users |
| 31 | + |
| 32 | +Users are added to chambers as either **Chamber Admin** or **Chamber User** roles. You can learn more about [user personas in Modeling and Simulation Workbench](concept-user-personas.md) to pick the most fitting role. |
| 33 | + |
| 34 | +If the user isn't already an **Owner** of either the subscription or the resource group, they must be assigned the following roles in addition to a chamber role. Microsoft recommends using least privilege to protect your environment by assigning the lowest level of privilege needed to effectively perform tasks. |
| 35 | + |
| 36 | +| Setting | Value | |
| 37 | +| :--------------- | :-------------------------------------- | |
| 38 | +| **Role** | **Reader** | |
| 39 | +| **Assign access to** | **User, group, or service principal** | |
| 40 | +| **Members** | \<user's Azure account\> | |
| 41 | + |
| 42 | +| Setting | Value | |
| 43 | +| :--------------- | :-------------------------------------- | |
| 44 | +| **Role** | **Classic Storage Account Contributor** | |
| 45 | +| **Assign access to** | **User, group, or service principal** | |
| 46 | +| **Members** | \<user's Azure account\> | |
| 47 | + |
| 48 | +1. Navigate to the Resource Group where the workbench is deployed. |
| 49 | +1. Select **Access Control (IAM)** from the left menu. |
| 50 | +1. From the roles screen, select **Add** > **Add role assignment**. |
| 51 | + :::image type="content" source="./media/quickstart-create-portal/chamber-iam-02.png" alt-text="Screenshot that shows selections for adding a role assignment."::: |
| 52 | +1. The **Add role assignment** pane opens. In the **Role** list, search for or scroll to find the **Reader** role. Select **Next**. |
| 53 | + :::image type="content" source="./media/quickstart-create-portal/chamber-iam-03.png" alt-text="Screenshot of the Add role assignment page showing where you select the Role."::: |
| 54 | +1. Leave the **Assign access to** as the default of **User, group, or service principal**. Choose **+ Select members**. |
| 55 | +1. On the **Select members** panel, search for and select on the users to be added, and then choose **Select**. |
| 56 | + :::image type="content" source="./media/quickstart-create-portal/chamber-iam-04.png" alt-text="Screenshot of the pane for adding a role assignment and selecting a security principal."::: |
| 57 | +1. Select **Review + assign** to assign the selected role. |
| 58 | +1. Repeat these same steps, but assign the **Classic Storage Account Contributor** role for the same users. |
| 59 | + |
| 60 | +### Assign Chamber Admin or Chamber User role |
| 61 | + |
| 62 | +Resource group level privileges allow users to perform infrastructure level tasks in the environment, but don't define the user's privilege level. Users must be assigned a role for each chamber they're to have access to. The role assigned determines whether users have `root` privileges across that chamber. **Chamber Admin** has `sudo` privileges in all virtual machines (VM) in the chamber, whereas **Chamber User** doesn't. |
| 63 | + |
| 64 | +1. Navigate to the chamber where the role is to be assigned. Be sure you are at the chamber level, as chamber roles don't inherit. |
| 65 | +1. Select **Access Control (IAM)** from the left menu. |
| 66 | +1. From the roles screen, select **Add** > **Add role assignment**. |
| 67 | + :::image type="content" source="./media/quickstart-create-portal/chamber-iam-02.png" alt-text="Screenshot that shows selections for adding a role assignment."::: |
| 68 | +1. The **Add role assignment** pane opens. In the **Role** list, search for or scroll to find either the **Chamber User** or the **Chamber Admin** role. Select the appropriate role and then select **Next**. |
| 69 | + :::image type="content" source="./media/quickstart-create-portal/chamber-iam-03.png" alt-text="Screenshot of the Add role assignment page showing where you select the Role."::: |
| 70 | +1. Leave the **Assign access to** as the default of **User, group, or service principal**. Choose **+ Select members**. |
| 71 | +1. On the **Select members** panel, search for and select on the users to be added, and then choose **Select**. |
| 72 | + :::image type="content" source="./media/quickstart-create-portal/chamber-iam-04.png" alt-text="Screenshot of the pane for adding a role assignment and selecting a security principal."::: |
| 73 | +1. After you select all the users for that role, select **Review + assign** to assign the selected role. |
| 74 | + |
| 75 | + > [!NOTE] |
| 76 | + > Allow at least five minutes for the provisioning of the users to propagate throughout the chamber, so they have a successful login experience. |
0 commit comments