Skip to content

Commit 39c2086

Browse files
v-ccolinv-ccolin
authored
Merge pull request #287551 from rolyon/rolyon-rbac-roles-privileged-category-v2
[Azure RBAC] Privileged roles category v2
2 parents 112e120 + 7d0ab11 commit 39c2086

File tree

6 files changed

+279
-249
lines changed

6 files changed

+279
-249
lines changed

‎articles/role-based-access-control/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,8 @@
171171
items:
172172
- name: Built-in roles
173173
href: built-in-roles.md
174+
- name: Privileged
175+
href: built-in-roles/privileged.md
174176
- name: General
175177
href: built-in-roles/general.md
176178
- name: Compute

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,23 @@ This article lists the Azure built-in roles. If you are looking for administrato
2020
The following table provides a brief description of each built-in role. Click the role name to see the list of `Actions`, `NotActions`, `DataActions`, and `NotDataActions` for each role. For information about what these actions mean and how they apply to the control and data planes, see [Understand Azure role definitions](/azure/role-based-access-control/role-definitions).
2121

2222

23+
## Privileged
24+
25+
> [!div class="mx-tableFixed"]
26+
> | Built-in role | Description | ID |
27+
> | --- | --- | --- |
28+
> | <a name='contributor'></a>[Contributor](./built-in-roles/privileged.md#contributor) | Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries. | b24988ac-6180-42a0-ab88-20f7382dd24c |
29+
> | <a name='owner'></a>[Owner](./built-in-roles/privileged.md#owner) | Grants full access to manage all resources, including the ability to assign roles in Azure RBAC. | 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 |
30+
> | <a name='reservations-administrator'></a>[Reservations Administrator](./built-in-roles/privileged.md#reservations-administrator) | Lets one read and manage all the reservations in a tenant | a8889054-8d42-49c9-bc1c-52486c10e7cd |
31+
> | <a name='role-based-access-control-administrator'></a>[Role Based Access Control Administrator](./built-in-roles/privileged.md#role-based-access-control-administrator) | Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy. | f58310d9-a9f6-439a-9e8d-f62e7b41a168 |
32+
> | <a name='user-access-administrator'></a>[User Access Administrator](./built-in-roles/privileged.md#user-access-administrator) | Lets you manage user access to Azure resources. | 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9 |
33+
2334
## General
2435

2536
> [!div class="mx-tableFixed"]
2637
> | Built-in role | Description | ID |
2738
> | --- | --- | --- |
28-
> | <a name='contributor'></a>[Contributor](./built-in-roles/general.md#contributor) | Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries. | b24988ac-6180-42a0-ab88-20f7382dd24c |
29-
> | <a name='owner'></a>[Owner](./built-in-roles/general.md#owner) | Grants full access to manage all resources, including the ability to assign roles in Azure RBAC. | 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 |
3039
> | <a name='reader'></a>[Reader](./built-in-roles/general.md#reader) | View all resources, but does not allow you to make any changes. | acdd72a7-3385-48ef-bd42-f606fba81ae7 |
31-
> | <a name='role-based-access-control-administrator'></a>[Role Based Access Control Administrator](./built-in-roles/general.md#role-based-access-control-administrator) | Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy. | f58310d9-a9f6-439a-9e8d-f62e7b41a168 |
32-
> | <a name='user-access-administrator'></a>[User Access Administrator](./built-in-roles/general.md#user-access-administrator) | Lets you manage user access to Azure resources. | 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9 |
3340
3441
## Compute
3542

@@ -502,7 +509,6 @@ The following table provides a brief description of each built-in role. Click th
502509
> | <a name='policy-insights-data-writer-preview'></a>[Policy Insights Data Writer (Preview)](./built-in-roles/management-and-governance.md#policy-insights-data-writer-preview) | Allows read access to resource policies and write access to resource component policy events. | 66bb4e9e-b016-4a94-8249-4c0511c2be84 |
503510
> | <a name='quota-request-operator'></a>[Quota Request Operator](./built-in-roles/management-and-governance.md#quota-request-operator) | Read and create quota requests, get quota request status, and create support tickets. | 0e5f05e5-9ab9-446b-b98d-1e2157c94125 |
504511
> | <a name='reservation-purchaser'></a>[Reservation Purchaser](./built-in-roles/management-and-governance.md#reservation-purchaser) | Lets you purchase reservations | f7b75c60-3036-4b75-91c3-6b41c27c1689 |
505-
> | <a name='reservations-administrator'></a>[Reservations Administrator](./built-in-roles/management-and-governance.md#reservations-administrator) | Lets one read and manage all the reservations in a tenant | a8889054-8d42-49c9-bc1c-52486c10e7cd |
506512
> | <a name='reservations-reader'></a>[Reservations Reader](./built-in-roles/management-and-governance.md#reservations-reader) | Lets one read all the reservations in a tenant | 582fc458-8989-419f-a480-75249bc5db7e |
507513
> | <a name='resource-policy-contributor'></a>[Resource Policy Contributor](./built-in-roles/management-and-governance.md#resource-policy-contributor) | Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy. | 36243c78-bf99-498c-9df9-86d9f8d28608 |
508514
> | <a name='savings-plan-purchaser'></a>[Savings plan Purchaser](./built-in-roles/management-and-governance.md#savings-plan-purchaser) | Lets you purchase savings plans | 3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74 |

‎articles/role-based-access-control/built-in-roles/general.md

Lines changed: 0 additions & 190 deletions
Original file line numberDiff line numberDiff line change
@@ -16,106 +16,6 @@ ms.custom: generated
1616
This article lists the Azure built-in roles in the General category.
1717

1818

19-
## Contributor
20-
21-
Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.
22-
23-
[Learn more](/azure/role-based-access-control/rbac-and-directory-admin-roles)
24-
25-
> [!div class="mx-tableFixed"]
26-
> | Actions | Description |
27-
> | --- | --- |
28-
> | * | Create and manage resources of all types |
29-
> | **NotActions** | |
30-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/Delete | Delete roles, policy assignments, policy definitions and policy set definitions |
31-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/Write | Create roles, role assignments, policy assignments, policy definitions and policy set definitions |
32-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/elevateAccess/Action | Grants the caller User Access Administrator access at the tenant scope |
33-
> | [Microsoft.Blueprint](../permissions/management-and-governance.md#microsoftblueprint)/blueprintAssignments/write | Create or update any blueprint assignments |
34-
> | [Microsoft.Blueprint](../permissions/management-and-governance.md#microsoftblueprint)/blueprintAssignments/delete | Delete any blueprint assignments |
35-
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
36-
> | [Microsoft.Purview](../permissions/analytics.md#microsoftpurview)/consents/write | Create or Update a Consent Resource. |
37-
> | [Microsoft.Purview](../permissions/analytics.md#microsoftpurview)/consents/delete | Delete the Consent Resource. |
38-
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentStacks/manageDenySetting/action | Manage the denySettings property of a deployment stack. |
39-
> | **DataActions** | |
40-
> | *none* | |
41-
> | **NotDataActions** | |
42-
> | *none* | |
43-
44-
```json
45-
{
46-
"assignableScopes": [
47-
"/"
48-
],
49-
"description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
50-
"id": "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
51-
"name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
52-
"permissions": [
53-
{
54-
"actions": [
55-
"*"
56-
],
57-
"notActions": [
58-
"Microsoft.Authorization/*/Delete",
59-
"Microsoft.Authorization/*/Write",
60-
"Microsoft.Authorization/elevateAccess/Action",
61-
"Microsoft.Blueprint/blueprintAssignments/write",
62-
"Microsoft.Blueprint/blueprintAssignments/delete",
63-
"Microsoft.Compute/galleries/share/action",
64-
"Microsoft.Purview/consents/write",
65-
"Microsoft.Purview/consents/delete",
66-
"Microsoft.Resources/deploymentStacks/manageDenySetting/action"
67-
],
68-
"dataActions": [],
69-
"notDataActions": []
70-
}
71-
],
72-
"roleName": "Contributor",
73-
"roleType": "BuiltInRole",
74-
"type": "Microsoft.Authorization/roleDefinitions"
75-
}
76-
```
77-
78-
## Owner
79-
80-
Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.
81-
82-
[Learn more](/azure/role-based-access-control/rbac-and-directory-admin-roles)
83-
84-
> [!div class="mx-tableFixed"]
85-
> | Actions | Description |
86-
> | --- | --- |
87-
> | * | Create and manage resources of all types |
88-
> | **NotActions** | |
89-
> | *none* | |
90-
> | **DataActions** | |
91-
> | *none* | |
92-
> | **NotDataActions** | |
93-
> | *none* | |
94-
95-
```json
96-
{
97-
"assignableScopes": [
98-
"/"
99-
],
100-
"description": "Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
101-
"id": "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
102-
"name": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
103-
"permissions": [
104-
{
105-
"actions": [
106-
"*"
107-
],
108-
"notActions": [],
109-
"dataActions": [],
110-
"notDataActions": []
111-
}
112-
],
113-
"roleName": "Owner",
114-
"roleType": "BuiltInRole",
115-
"type": "Microsoft.Authorization/roleDefinitions"
116-
}
117-
```
118-
11919
## Reader
12020

12121
View all resources, but does not allow you to make any changes.
@@ -157,96 +57,6 @@ View all resources, but does not allow you to make any changes.
15757
}
15858
```
15959

160-
## Role Based Access Control Administrator
161-
162-
Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.
163-
164-
> [!div class="mx-tableFixed"]
165-
> | Actions | Description |
166-
> | --- | --- |
167-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
168-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
169-
> | */read | Read resources of all types, except secrets. |
170-
> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
171-
> | **NotActions** | |
172-
> | *none* | |
173-
> | **DataActions** | |
174-
> | *none* | |
175-
> | **NotDataActions** | |
176-
> | *none* | |
177-
178-
```json
179-
{
180-
"assignableScopes": [
181-
"/"
182-
],
183-
"description": "Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.",
184-
"id": "/providers/Microsoft.Authorization/roleDefinitions/f58310d9-a9f6-439a-9e8d-f62e7b41a168",
185-
"name": "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
186-
"permissions": [
187-
{
188-
"actions": [
189-
"Microsoft.Authorization/roleAssignments/write",
190-
"Microsoft.Authorization/roleAssignments/delete",
191-
"*/read",
192-
"Microsoft.Support/*"
193-
],
194-
"notActions": [],
195-
"dataActions": [],
196-
"notDataActions": []
197-
}
198-
],
199-
"roleName": "Role Based Access Control Administrator",
200-
"roleType": "BuiltInRole",
201-
"type": "Microsoft.Authorization/roleDefinitions"
202-
}
203-
```
204-
205-
## User Access Administrator
206-
207-
Lets you manage user access to Azure resources.
208-
209-
[Learn more](/azure/role-based-access-control/rbac-and-directory-admin-roles)
210-
211-
> [!div class="mx-tableFixed"]
212-
> | Actions | Description |
213-
> | --- | --- |
214-
> | */read | Read resources of all types, except secrets. |
215-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/* | Manage authorization |
216-
> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
217-
> | **NotActions** | |
218-
> | *none* | |
219-
> | **DataActions** | |
220-
> | *none* | |
221-
> | **NotDataActions** | |
222-
> | *none* | |
223-
224-
```json
225-
{
226-
"assignableScopes": [
227-
"/"
228-
],
229-
"description": "Lets you manage user access to Azure resources.",
230-
"id": "/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
231-
"name": "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
232-
"permissions": [
233-
{
234-
"actions": [
235-
"*/read",
236-
"Microsoft.Authorization/*",
237-
"Microsoft.Support/*"
238-
],
239-
"notActions": [],
240-
"dataActions": [],
241-
"notDataActions": []
242-
}
243-
],
244-
"roleName": "User Access Administrator",
245-
"roleType": "BuiltInRole",
246-
"type": "Microsoft.Authorization/roleDefinitions"
247-
}
248-
```
249-
25060
## Next steps
25161

25262
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)

‎articles/role-based-access-control/built-in-roles/management-and-governance.md

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1963,59 +1963,6 @@ Lets you purchase reservations
19631963
}
19641964
```
19651965

1966-
## Reservations Administrator
1967-
1968-
Lets one read and manage all the reservations in a tenant
1969-
1970-
[Learn more](/azure/cost-management-billing/reservations/view-reservations)
1971-
1972-
> [!div class="mx-tableFixed"]
1973-
> | Actions | Description |
1974-
> | --- | --- |
1975-
> | [Microsoft.Capacity](../permissions/general.md#microsoftcapacity)/*/read | |
1976-
> | [Microsoft.Capacity](../permissions/general.md#microsoftcapacity)/*/action | |
1977-
> | [Microsoft.Capacity](../permissions/general.md#microsoftcapacity)/*/write | |
1978-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |
1979-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |
1980-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
1981-
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
1982-
> | **NotActions** | |
1983-
> | *none* | |
1984-
> | **DataActions** | |
1985-
> | *none* | |
1986-
> | **NotDataActions** | |
1987-
> | *none* | |
1988-
1989-
```json
1990-
{
1991-
"assignableScopes": [
1992-
"/providers/Microsoft.Capacity"
1993-
],
1994-
"description": "Lets one read and manage all the reservations in a tenant",
1995-
"id": "/providers/Microsoft.Authorization/roleDefinitions/a8889054-8d42-49c9-bc1c-52486c10e7cd",
1996-
"name": "a8889054-8d42-49c9-bc1c-52486c10e7cd",
1997-
"permissions": [
1998-
{
1999-
"actions": [
2000-
"Microsoft.Capacity/*/read",
2001-
"Microsoft.Capacity/*/action",
2002-
"Microsoft.Capacity/*/write",
2003-
"Microsoft.Authorization/roleAssignments/read",
2004-
"Microsoft.Authorization/roleDefinitions/read",
2005-
"Microsoft.Authorization/roleAssignments/write",
2006-
"Microsoft.Authorization/roleAssignments/delete"
2007-
],
2008-
"notActions": [],
2009-
"dataActions": [],
2010-
"notDataActions": []
2011-
}
2012-
],
2013-
"roleName": "Reservations Administrator",
2014-
"roleType": "BuiltInRole",
2015-
"type": "Microsoft.Authorization/roleDefinitions"
2016-
}
2017-
```
2018-
20191966
## Reservations Reader
20201967

20211968
Lets one read all the reservations in a tenant

0 commit comments

Comments
 (0)