Skip to content

Commit 2e7ce78

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #291003 from AbhishekMallick-MS/Nov-25-2024-VM
Restore VM updates
2 parents 6ab3b97 + 96367eb commit 2e7ce78

File tree

3 files changed

+173
-20
lines changed

3 files changed

+173
-20
lines changed

‎articles/backup/backup-azure-arm-restore-vms.md

Lines changed: 55 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -330,34 +330,69 @@ For more information, see [Back up and restore Active Directory domain controlle
330330

331331
Managed identities eliminate the need for the user to maintain the credentials. Managed identities provide an identity for applications to use when connecting to resources that support Microsoft Entra authentication.
332332

333-
Azure Backup offers the flexibility to restore the managed Azure VM with [managed identities](../active-directory/managed-identities-azure-resources/overview.md). You can choose to select [system-managed identities](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the [**Restore configuration** blade](#create-a-vm) of Azure VM. Managed identities used as one of the input parameters is only used for accessing the storage accounts, which are used as staging location during restore and not for any other Azure resource controlling. These managed identities have to be associated to the vault.
333+
Azure Backup offers the flexibility to restore the managed Azure VM with [managed identities](../active-directory/managed-identities-azure-resources/overview.md). You can choose to select [system-managed identities](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the [**Restore configuration** blade](#create-a-vm) of Azure VM. Managed identities are used for accessing the storage accounts and automated cleanup of any resources created during restore process in case of restore failures. These managed identities have to be associated to the vault.
334334

335335
:::image type="content" source="./media/backup-azure-arm-restore-vms/select-system-managed-identities-or-user-managed-identities.png" alt-text="Screenshot for choice to select system-managed identities or user-managed identities.":::
336336

337-
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account.
337+
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account and Resource Group.
338338

339339
```json
340340
"permissions": [
341-
{
342-
"actions": [
343-
"Microsoft.Authorization/*/read",
344-
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
345-
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
346-
"Microsoft.Storage/storageAccounts/blobServices/containers/write"
347-
],
348-
"notActions": [],
349-
"dataActions": [
350-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
351-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
352-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
353-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
354-
],
355-
"notDataActions": []
356-
}
357-
]
341+
{
342+
"actions": [
343+
"Microsoft.Authorization/*/read",
344+
"Microsoft.Compute/disks/read",
345+
"Microsoft.Compute/disks/write",
346+
"Microsoft.Compute/disks/delete",
347+
"Microsoft.Compute/disks/beginGetAccess/action",
348+
"Microsoft.Compute/disks/endGetAccess/action",
349+
"Microsoft.Compute/locations/diskOperations/read",
350+
"Microsoft.Compute/virtualMachines/read",
351+
"Microsoft.Compute/virtualMachines/write",
352+
"Microsoft.Compute/virtualMachines/delete",
353+
"Microsoft.Compute/virtualMachines/instanceView/read",
354+
"Microsoft.Compute/virtualMachines/extensions/read",
355+
"Microsoft.Compute/virtualMachines/extensions/write",
356+
"Microsoft.Compute/virtualMachines/extensions/delete",
357+
"Microsoft.Insights/alertRules/*",
358+
"Microsoft.Network/locations/operationResults/read",
359+
"Microsoft.Network/locations/operations/read",
360+
"Microsoft.Network/locations/usages/read",
361+
"Microsoft.Network/networkInterfaces/delete",
362+
"Microsoft.Network/networkInterfaces/ipconfigurations/read",
363+
"Microsoft.Network/networkInterfaces/join/action",
364+
"Microsoft.Network/networkInterfaces/read",
365+
"Microsoft.Network/networkInterfaces/write",
366+
"Microsoft.Network/networkSecurityGroups/read",
367+
"Microsoft.Network/networkSecurityGroups/securityRules/read",
368+
"Microsoft.Network/publicIPAddresses/delete",
369+
"Microsoft.Network/publicIPAddresses/join/action",
370+
"Microsoft.Network/publicIPAddresses/read",
371+
"Microsoft.Network/publicIPAddresses/write",
372+
"Microsoft.Network/virtualNetworks/read",
373+
"Microsoft.Network/virtualNetworks/subnets/join/action",
374+
"Microsoft.Network/virtualNetworks/subnets/read",
375+
"Microsoft.Resources/deployments/*",
376+
"Microsoft.Resources/subscriptions/resourceGroups/read",
377+
"Microsoft.Storage/checkNameAvailability/read",
378+
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
379+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
380+
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
381+
"Microsoft.Storage/storageAccounts/listKeys/action",
382+
"Microsoft.Storage/storageAccounts/read",
383+
"Microsoft.Storage/storageAccounts/write"
384+
],
385+
"notActions": [],
386+
"dataActions": [
387+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
388+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
389+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
390+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
391+
],
392+
358393
```
359394

360-
Or, add the role assignment on the staging location (Storage Account) to have [Storage account Backup Contributor](./blob-backup-configure-manage.md#grant-permissions-to-the-backup-vault-on-storage-accounts) and [Storage Blob data Contributor](../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) for the successful restore operation.
395+
Or, add the **VM restore operator** role assignment on the staging location (Storage Account) and target Resource Group for the successful restore operation.
361396

362397
:::image type="content" source="./media/backup-azure-arm-restore-vms/add-role-assignment-on-staging-location.png" alt-text="Screenshot for adding the role assignment on the staging location.":::
363398

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ The following table provides a brief description of each built-in role. Click th
7171
> | <a name='virtual-machine-data-access-administrator-preview'></a>[Virtual Machine Data Access Administrator (preview)](./built-in-roles/compute.md#virtual-machine-data-access-administrator-preview) | Manage access to Virtual Machines by adding or removing role assignments for the Virtual Machine Administrator Login and Virtual Machine User Login roles. Includes an ABAC condition to constrain role assignments. | 66f75aeb-eabe-4b70-9f1e-c350c4c9ad04 |
7272
> | <a name='virtual-machine-local-user-login'></a>[Virtual Machine Local User Login](./built-in-roles/compute.md#virtual-machine-local-user-login) | View Virtual Machines in the portal and login as a local user configured on the arc server | 602da2ba-a5c2-41da-b01d-5360126ab525 |
7373
> | <a name='virtual-machine-user-login'></a>[Virtual Machine User Login](./built-in-roles/compute.md#virtual-machine-user-login) | View Virtual Machines in the portal and login as a regular user. | fb879df8-f326-4884-b1cf-06f3ad86be52 |
74+
> | [Virtual Machine Restore Operator](/azure/role-based-access-control/built-in-roles/compute#virtual-machine-operator) | Provides permissions to Recovery Services vault to staging storage account and target resource group for VM restore operations. | dfce897125e342e3ba336055438e3080 |
7475
> | <a name='windows-365-network-interface-contributor'></a>[Windows 365 Network Interface Contributor](./built-in-roles/compute.md#windows-365-network-interface-contributor) | This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces. | 1f135831-5bbe-4924-9016-264044c00788 |
7576
> | <a name='windows-365-network-user'></a>[Windows 365 Network User](./built-in-roles/compute.md#windows-365-network-user) | This role is used by Windows 365 to read virtual networks and join the designated virtual networks. | 7eabc9a4-85f7-4f71-b8ab-75daaccc1033 |
7677
> | <a name='windows-admin-center-administrator-login'></a>[Windows Admin Center Administrator Login](./built-in-roles/compute.md#windows-admin-center-administrator-login) | Let's you manage the OS of your resource via Windows Admin Center as an administrator. | a6333a3e-0164-44c3-b281-7a577aff287f |

‎articles/role-based-access-control/built-in-roles/compute.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1856,6 +1856,123 @@ View Virtual Machines in the portal and login as a regular user.
18561856
}
18571857
```
18581858

1859+
## Virtual Machine Operator
1860+
1861+
This role is for providing necessary permissions on the staging storage account and target resource group during VM restore operations using Azure Backup.
1862+
1863+
> [!div class="mx-tableFixed"]
1864+
> | Actions | Description |
1865+
> | --- | --- |
1866+
> | Microsoft.Authorization/*/read | Read access to all authorization resources |
1867+
> | Microsoft.Compute/disks/read | Read access to compute disks |
1868+
> | Microsoft.Compute/disks/write | Write access to compute disks |
1869+
> | Microsoft.Compute/disks/delete | Delete access to compute disks |
1870+
> | Microsoft.Compute/disks/beginGetAccess/action | Begin get access action on compute disks |
1871+
> | Microsoft.Compute/disks/endGetAccess/action | End get access action on compute disks |
1872+
> | Microsoft.Compute/locations/diskOperations/read | Read access to disk operations in a location |
1873+
> | Microsoft.Compute/virtualMachines/read | Read access to virtual machines |
1874+
> | Microsoft.Compute/virtualMachines/write | Write access to virtual machines |
1875+
> | Microsoft.Compute/virtualMachines/delete | Delete access to virtual machines |
1876+
> | Microsoft.Compute/virtualMachines/instanceView/read | Read access to virtual machine instance view |
1877+
> | Microsoft.Compute/virtualMachines/extensions/read | Read access to virtual machine extensions |
1878+
> | Microsoft.Compute/virtualMachines/extensions/write | Write access to virtual machine extensions |
1879+
> | Microsoft.Compute/virtualMachines/extensions/delete | Delete access to virtual machine extensions |
1880+
> | Microsoft.Insights/alertRules/* | Full access to alert rules |
1881+
> | Microsoft.Network/locations/operationResults/read | Read access to operation results in a location |
1882+
> | Microsoft.Network/locations/operations/read | Read access to operations in a location |
1883+
> | Microsoft.Network/locations/usages/read | Read access to usage information in a location |
1884+
> | Microsoft.Network/networkInterfaces/delete | Delete access to network interfaces |
1885+
> | Microsoft.Network/networkInterfaces/ipconfigurations/read | Read access to IP configurations of network interfaces |
1886+
> | Microsoft.Network/networkInterfaces/join/action | Join action on network interfaces |
1887+
> | Microsoft.Network/networkInterfaces/read | Read access to network interfaces |
1888+
> | Microsoft.Network/networkInterfaces/write | Write access to network interfaces |
1889+
> | Microsoft.Network/networkSecurityGroups/read | Read access to network security groups |
1890+
> | Microsoft.Network/networkSecurityGroups/securityRules/read | Read access to security rules of network security groups |
1891+
> | Microsoft.Network/publicIPAddresses/delete | Delete access to public IP addresses |
1892+
> | Microsoft.Network/publicIPAddresses/join/action | Join action on public IP addresses |
1893+
> | Microsoft.Network/publicIPAddresses/read | Read access to public IP addresses |
1894+
> | Microsoft.Network/publicIPAddresses/write | Write access to public IP addresses |
1895+
> | Microsoft.Network/virtualNetworks/read | Read access to virtual networks |
1896+
> | Microsoft.Network/virtualNetworks/subnets/join/action | Join action on virtual network subnets |
1897+
> | Microsoft.Network/virtualNetworks/subnets/read | Read access to virtual network subnets |
1898+
> | Microsoft.Resources/deployments/* | Full access to resource deployments |
1899+
> | Microsoft.Resources/subscriptions/resourceGroups/read | Read access to resource groups in a subscription |
1900+
> | Microsoft.Storage/checkNameAvailability/read | Read access to check name availability |
1901+
> | Microsoft.Storage/storageAccounts/blobServices/containers/delete | Delete access to blob service containers in storage accounts |
1902+
> | Microsoft.Storage/storageAccounts/blobServices/containers/read | Read access to blob service containers in storage accounts |
1903+
> | Microsoft.Storage/storageAccounts/blobServices/containers/write | Write access to blob service containers in storage accounts |
1904+
> | Microsoft.Storage/storageAccounts/listKeys/action | List keys action on storage accounts |
1905+
> | Microsoft.Storage/storageAccounts/read | Read access to storage accounts |
1906+
> | Microsoft.Storage/storageAccounts/write | Write access to storage accounts |
1907+
> | NotActions | |
1908+
> | none | |
1909+
> | DataActions | |
1910+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete | Delete access to blobs in blob service containers |
1911+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read | Read access to blobs in blob service containers |
1912+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write | Write access to blobs in blob service containers |
1913+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action | Add action on blobs in blob service containers |
1914+
> | NotDataActions | |
1915+
> | none | |
1916+
1917+
```json
1918+
"permissions": [
1919+
{
1920+
"actions": [
1921+
"Microsoft.Authorization/*/read",
1922+
"Microsoft.Compute/disks/read",
1923+
"Microsoft.Compute/disks/write",
1924+
"Microsoft.Compute/disks/delete",
1925+
"Microsoft.Compute/disks/beginGetAccess/action",
1926+
"Microsoft.Compute/disks/endGetAccess/action",
1927+
"Microsoft.Compute/locations/diskOperations/read",
1928+
"Microsoft.Compute/virtualMachines/read",
1929+
"Microsoft.Compute/virtualMachines/write",
1930+
"Microsoft.Compute/virtualMachines/delete",
1931+
"Microsoft.Compute/virtualMachines/instanceView/read",
1932+
"Microsoft.Compute/virtualMachines/extensions/read",
1933+
"Microsoft.Compute/virtualMachines/extensions/write",
1934+
"Microsoft.Compute/virtualMachines/extensions/delete",
1935+
"Microsoft.Insights/alertRules/*",
1936+
"Microsoft.Network/locations/operationResults/read",
1937+
"Microsoft.Network/locations/operations/read",
1938+
"Microsoft.Network/locations/usages/read",
1939+
"Microsoft.Network/networkInterfaces/delete",
1940+
"Microsoft.Network/networkInterfaces/ipconfigurations/read",
1941+
"Microsoft.Network/networkInterfaces/join/action",
1942+
"Microsoft.Network/networkInterfaces/read",
1943+
"Microsoft.Network/networkInterfaces/write",
1944+
"Microsoft.Network/networkSecurityGroups/read",
1945+
"Microsoft.Network/networkSecurityGroups/securityRules/read",
1946+
"Microsoft.Network/publicIPAddresses/delete",
1947+
"Microsoft.Network/publicIPAddresses/join/action",
1948+
"Microsoft.Network/publicIPAddresses/read",
1949+
"Microsoft.Network/publicIPAddresses/write",
1950+
"Microsoft.Network/virtualNetworks/read",
1951+
"Microsoft.Network/virtualNetworks/subnets/join/action",
1952+
"Microsoft.Network/virtualNetworks/subnets/read",
1953+
"Microsoft.Resources/deployments/*",
1954+
"Microsoft.Resources/subscriptions/resourceGroups/read",
1955+
"Microsoft.Storage/checkNameAvailability/read",
1956+
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
1957+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
1958+
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
1959+
"Microsoft.Storage/storageAccounts/listKeys/action",
1960+
"Microsoft.Storage/storageAccounts/read",
1961+
"Microsoft.Storage/storageAccounts/write"
1962+
],
1963+
"notActions": [],
1964+
"dataActions": [
1965+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
1966+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
1967+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
1968+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
1969+
],
1970+
1971+
1972+
1973+
```
1974+
1975+
18591976
## Windows 365 Network Interface Contributor
18601977

18611978
This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces.

0 commit comments

Comments
 (0)