@@ -113,7 +113,7 @@ Azure Policy has several permissions, known as operations, in two Resource Provi
113
113
- [ Microsoft.Authorization] ( ../../role-based-access-control/resource-provider-operations.md#microsoftauthorization )
114
114
- [ Microsoft.PolicyInsights] ( ../../role-based-access-control/resource-provider-operations.md#microsoftpolicyinsights )
115
115
116
- Many Built -in roles grant permission to Azure Policy resources. The ** Resource Policy Contributor**
116
+ Many built -in roles grant permission to Azure Policy resources. The ** Resource Policy Contributor**
117
117
role includes most Azure Policy operations. ** Owner** has full rights. Both ** Contributor** and
118
118
** Reader** have access to all _ read_ Azure Policy operations.
119
119
@@ -123,14 +123,14 @@ necessary to grant the managed identity on **deployIfNotExists** or **modify** a
123
123
permissions.
124
124
125
125
> [ !NOTE]
126
- > All Policy objects, including definitions, initatives , and assignments, will be readable to all
127
- > roles over its scope. For example, a Policy assignment scoped to an Azure subscription will be readable
126
+ > All Policy objects, including definitions, initiatives , and assignments, will be readable to all
127
+ > roles over its scope. For example, a Policy assignment scoped to an Azure subscription will be readable
128
128
> by all role holders at the subscription scope and below.
129
129
130
- If none of the Built -in roles have the permissions required, create a
130
+ If none of the built -in roles have the permissions required, create a
131
131
[ custom role] ( ../../role-based-access-control/custom-roles.md ) .
132
132
133
- Azure Policy operations can have a significant impact on your Azure environment. Only the minimum set of
133
+ Azure Policy operations can have a significant impact on your Azure environment. Only the minimum set of
134
134
permissions necessary to perform a task should be assigned and these permissions should not be granted
135
135
to users who do not need them.
136
136
@@ -170,7 +170,7 @@ Here are a few pointers and tips to keep in mind:
170
170
171
171
- Once you've created an initiative assignment, policy definitions added to the initiative also
172
172
become part of that initiative's assignments.
173
-
173
+
174
174
- When an initiative assignment is evaluated, all policies within the initiative are also evaluated.
175
175
If you need to evaluate a policy individually, it's better to not include it in an initiative.
176
176
0 commit comments