Skip to content

Commit 1e447d3

Browse files
denreadenrea
authored
Merge pull request #293351 from wtnlee/customrole
Customrole
2 parents 960a5e2 + 6274d45 commit 1e447d3

File tree

1 file changed

+58
-47
lines changed

1 file changed

+58
-47
lines changed

‎articles/virtual-wan/roles-permissions.md

Lines changed: 58 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -29,36 +29,39 @@ For more information, see [Steps to create a custom role](../role-based-access-c
2929
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities interacting with Virtual WAN have the necessary permissions.
3030
To add any missing permissions listed here, see [Update a custom role](../role-based-access-control/custom-roles-portal.md#update-a-custom-role).
3131

32-
The following custom roles are a few example roles you can create in your tenant if you don't want to leverage more generic built-in roles such as Network Contributor or Contributor.
32+
The following custom roles are a few example roles you can create in your tenant if you don't want to leverage more generic built-in roles such as Network Contributor or Contributor. You can download and save the sample roles as JSON files and upload the JSON file to Azure portal when creating custom roles in your tenant. Ensure the assignable scopes for the custom roles are set properly for your networking resource subscription(s).
3333

3434
### Virtual WAN Administrator
3535

3636
The Virtual WAN Administrator role has the ability to perform all operations related to the Virtual Hub, including managing connections to Virtual WAN and configuring routing.
3737

3838
```
3939
{
40-
"Name": "Virtual WAN Administrator",
41-
"IsCustom": true,
42-
"Description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
43-
"Actions": [
44-
"Microsoft.Network/virtualWans/*",
45-
"Microsoft.Network/virtualHubs/*",
46-
"Microsoft.Network/azureFirewalls/read",
47-
"Microsoft.Network/networkVirtualAppliances/*/read",
48-
"Microsoft.Network/securityPartnerProviders/*/read",
49-
"Microsoft.Network/expressRouteGateways/*",
50-
"Microsoft.Network/vpnGateways/*",
51-
"Microsoft.Network/p2sVpnGateways/*",
52-
"Microsoft.Network/virtualNetworks/peer/action"
53-
54-
],
55-
"NotActions": [],
56-
"DataActions": [],
57-
"NotDataActions": [],
58-
"AssignableScopes": [
59-
"/subscriptions/{subscriptionId1}",
60-
"/subscriptions/{subscriptionId2}"
61-
]
40+
"properties": {
41+
"roleName": "Virtual WAN Administrator",
42+
"description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
43+
"assignableScopes": [
44+
"/subscriptions/<>"
45+
],
46+
"permissions": [
47+
{
48+
"actions": [
49+
"Microsoft.Network/virtualWans/*",
50+
"Microsoft.Network/virtualHubs/*",
51+
"Microsoft.Network/azureFirewalls/read",
52+
"Microsoft.Network/networkVirtualAppliances/*/read",
53+
"Microsoft.Network/securityPartnerProviders/*/read",
54+
"Microsoft.Network/expressRouteGateways/*",
55+
"Microsoft.Network/vpnGateways/*",
56+
"Microsoft.Network/p2sVpnGateways/*",
57+
"Microsoft.Network/virtualNetworks/peer/action"
58+
],
59+
"notActions": [],
60+
"dataActions": [],
61+
"notDataActions": []
62+
}
63+
]
64+
}
6265
}
6366
```
6467

@@ -68,37 +71,45 @@ The Virtual WAN reader role has the ability to view and monitor all Virtual WAN-
6871

6972
```
7073
{
71-
"Name": "Virtual WAN Reader",
72-
"IsCustom": true,
73-
"Description": "Can read and monitor all Virtual WAN resources, but cannot modify Virtual WAN resources.",
74-
"Actions": [
75-
"Microsoft.Network/virtualWans/*/read",
76-
"Microsoft.Network/virtualHubs/*/read",
77-
"Microsoft.Network/expressRouteGateways/*/read",
78-
"Microsoft.Network/vpnGateways/*/read",
79-
"Microsoft.Network/p2sVpnGateways/*/read"
80-
"Microsoft.Network/networkVirtualAppliances/*/read
81-
],
82-
"NotActions": [],
83-
"DataActions": [],
84-
"NotDataActions": [],
85-
"AssignableScopes": [
86-
"/subscriptions/{subscriptionId1}",
87-
"/subscriptions/{subscriptionId2}"
88-
]
74+
"properties": {
75+
"roleName": "Virtual WAN reader",
76+
"description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
77+
"assignableScopes": [
78+
"/subscriptions/<>"
79+
],
80+
"permissions": [
81+
{
82+
"actions": [
83+
"Microsoft.Network/virtualWans/*",
84+
"Microsoft.Network/virtualHubs/*",
85+
"Microsoft.Network/azureFirewalls/read",
86+
"Microsoft.Network/networkVirtualAppliances/*/read",
87+
"Microsoft.Network/securityPartnerProviders/*/read",
88+
"Microsoft.Network/expressRouteGateways/*",
89+
"Microsoft.Network/vpnGateways/*",
90+
"Microsoft.Network/p2sVpnGateways/*",
91+
"Microsoft.Network/virtualNetworks/peer/action"
92+
],
93+
"notActions": [],
94+
"dataActions": [],
95+
"notDataActions": []
96+
}
97+
]
98+
}
8999
}
90100
```
101+
91102
## Required Permissions
92103

93104
Creating or updating Virtual WAN resources requires you to have the proper permission(s) to create that Virtual WAN resource type. In some scenarios, having permissions to create or update that resource type is sufficient. However, in many scenarios, updating a Virtual WAN resource that has a **reference** to another Azure resource requires you to have permissions over both the created resource **and** any referenced resources.
94105

95106
### Error Message
96107

97-
A user or service principal must have sufficient permissions to execute an operation on a Virtual WAN resource. If the user does not have sufficient permissions to perform the operation, the operation will fail with an error message similar to the one below.
108+
A user or service principal must have sufficient permissions to execute an operation on a Virtual WAN resource. If the user doesn't have sufficient permissions to perform the operation, the operation will fail with an error message similar to the one below.
98109

99110
|Error Code| Message|
100111
|--|--|
101-
|LinkedAccessCheckFailed| The client with object id 'xxx' does not have authorization to perform action 'xxx' over scope 'zzz resource' or the scope is invalid. For details on the required permissions, please visit 'zzz'. If access was recently granted, please refresh your credentials.|
112+
|LinkedAccessCheckFailed| The client with object id 'xxx' does not have authorization to perform action 'xxx' over scope 'zzz resource' or the scope is invalid. For details on the required permissions, please visit 'zzz.' If access was recently granted, please refresh your credentials.|
102113

103114
> [!NOTE]
104115
> A user or service principal may be missing multiple permissions needed to manage a Virtual WAN resource. The returned error message only references one missing permission. As a result, you may see a different missing permission after you update the permissions assigned to your service principal or user.
@@ -107,7 +118,7 @@ To fix this error, grant the user or service principal that is managing your Vir
107118

108119
### Example 1
109120

110-
When a connection is created between a Virtual WAN hub and a spoke Virtual Network, Virtual WAN's control plane creates a Virutal Network peering between the Virtual WAN hub and your spoke Virtual Network. You can also specify the Virtual WAN route tables to which the Virtual Network connection is associating to or propagating to.
121+
When a connection is created between a Virtual WAN hub and a spoke Virtual Network, Virtual WAN's control plane creates a Virtual Network peering between the Virtual WAN hub and your spoke Virtual Network. You can also specify the Virtual WAN route tables to which the Virtual Network connection is associating to or propagating to.
111122

112123
Therefore, to create a Virtual Network connection to the Virtual WAN hub, you must have the following permissions:
113124

@@ -123,17 +134,17 @@ If you want to associate an inbound or out-bound route map is associated with th
123134

124135
To create or modify routing intent, a routing intent resource is created with a reference to the next hop resources specified in the routing intent's routing policy. This means that to create or modify routing intent, you need permissions over any referenced Azure Firewall or Network Virtual Appliance resource(s).
125136

126-
If the next hop for a hub's private routing intent policy is a Network Virtual Appliance and the next hop for a hub's internet policy is an Azure Firewall, creating or updating a routing intent resource requires the following permisisons.
137+
If the next hop for a hub's private routing intent policy is a Network Virtual Appliance and the next hop for a hub's internet policy is an Azure Firewall, creating or updating a routing intent resource requires the following permissions.
127138

128139
* Create routing intent resource. (Microsoft.Network/virtualhubs/routingIntents/write)
129140
* Reference (read) the Network Virtual Appliance resource (Microsoft.Network/networkVirtualAppliances/read)
130141
* Reference (read) the Azure Firewall resource (Microsoft.Network/azureFirewalls)
131142

132-
In this example, you do **not** need permissions to read Microsoft.Network/securityPartnerProviders resources because the routing intent configured does not reference a third-party security provider resource.
143+
In this example, you do **not** need permissions to read Microsoft.Network/securityPartnerProviders resources because the routing intent configured doesn't reference a third-party security provider resource.
133144

134145
## Additional permissions required due to referenced resources
135146

136-
The following section describes the set of possible permisisons that are needed to create or modify Virtual WAN resources.
147+
The following section describes the set of possible permissions that are needed to create or modify Virtual WAN resources.
137148

138149
Depending on your Virtual WAN configuration, the user or service principal that is managing your Virtual WAN deployments may need all, a subset or none of the below permissions over referenced resources.
139150

0 commit comments

Comments
 (0)