Skip to content

Commit 3f468a9

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #287180 from rolyon/rolyon-rbac-roles-app-configuration
[Azure RBAC] App Configuration roles
2 parents 7419030 + 04f2eaf commit 3f468a9

File tree

2 files changed

+98
-0
lines changed

2 files changed

+98
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,8 +338,10 @@ The following table provides a brief description of each built-in role. Click th
338338
> | <a name='api-management-workspace-api-product-manager'></a>[API Management Workspace API Product Manager](./built-in-roles/integration.md#api-management-workspace-api-product-manager) | Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope. | 73c2c328-d004-4c5e-938c-35c6f5679a1f |
339339
> | <a name='api-management-workspace-contributor'></a>[API Management Workspace Contributor](./built-in-roles/integration.md#api-management-workspace-contributor) | Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope. | 0c34c906-8d99-4cb7-8bb7-33f5b0a1a799 |
340340
> | <a name='api-management-workspace-reader'></a>[API Management Workspace Reader](./built-in-roles/integration.md#api-management-workspace-reader) | Has read-only access to entities in the workspace. This role should be assigned on the workspace scope. | ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2 |
341+
> | <a name='app-configuration-contributor'></a>[App Configuration Contributor](./built-in-roles/integration.md#app-configuration-contributor) | Grants permission for all management operations, except purge, for App Configuration resources. | fe86443c-f201-4fc4-9d2a-ac61149fbda0 |
341342
> | <a name='app-configuration-data-owner'></a>[App Configuration Data Owner](./built-in-roles/integration.md#app-configuration-data-owner) | Allows full access to App Configuration data. | 5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b |
342343
> | <a name='app-configuration-data-reader'></a>[App Configuration Data Reader](./built-in-roles/integration.md#app-configuration-data-reader) | Allows read access to App Configuration data. | 516239f1-63e1-4d78-a4de-a74fb236a071 |
344+
> | <a name='app-configuration-reader'></a>[App Configuration Reader](./built-in-roles/integration.md#app-configuration-reader) | Grants permission for read operations for App Configuration resources. | 175b81b9-6e0d-490a-85e4-0d422273c10c |
343345
> | <a name='azure-api-center-compliance-manager'></a>[Azure API Center Compliance Manager](./built-in-roles/integration.md#azure-api-center-compliance-manager) | Allows managing API compliance in Azure API Center service. | ede9aaa3-4627-494e-be13-4aa7c256148d |
344346
> | <a name='azure-api-center-data-reader'></a>[Azure API Center Data Reader](./built-in-roles/integration.md#azure-api-center-data-reader) | Allows for access to Azure API Center data plane read operations. | c7244dfb-f447-457d-b2ba-3999044d1706 |
345347
> | <a name='azure-api-center-service-contributor'></a>[Azure API Center Service Contributor](./built-in-roles/integration.md#azure-api-center-service-contributor) | Allows managing Azure API Center service. | dd24193f-ef65-44e5-8a7e-6fa6e03f7713 |

‎articles/role-based-access-control/built-in-roles/integration.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -578,6 +578,55 @@ Has read-only access to entities in the workspace. This role should be assigned
578578
}
579579
```
580580

581+
## App Configuration Contributor
582+
583+
Grants permission for all management operations, except purge, for App Configuration resources.
584+
585+
> [!div class="mx-tableFixed"]
586+
> | Actions | Description |
587+
> | --- | --- |
588+
> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/* | |
589+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
590+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
591+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
592+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
593+
> | **NotActions** | |
594+
> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/locations/deletedConfigurationStores/purge/action | Purge the specified deleted configuration store. |
595+
> | **DataActions** | |
596+
> | *none* | |
597+
> | **NotDataActions** | |
598+
> | *none* | |
599+
600+
```json
601+
{
602+
"assignableScopes": [
603+
"/"
604+
],
605+
"description": "Grants permission for all management operations, except purge, for App Configuration resources.",
606+
"id": "/providers/Microsoft.Authorization/roleDefinitions/fe86443c-f201-4fc4-9d2a-ac61149fbda0",
607+
"name": "fe86443c-f201-4fc4-9d2a-ac61149fbda0",
608+
"permissions": [
609+
{
610+
"actions": [
611+
"Microsoft.AppConfiguration/*",
612+
"Microsoft.Authorization/*/read",
613+
"Microsoft.Insights/alertRules/*",
614+
"Microsoft.Resources/deployments/*",
615+
"Microsoft.Resources/subscriptions/resourceGroups/read"
616+
],
617+
"notActions": [
618+
"Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"
619+
],
620+
"dataActions": [],
621+
"notDataActions": []
622+
}
623+
],
624+
"roleName": "App Configuration Contributor",
625+
"roleType": "BuiltInRole",
626+
"type": "Microsoft.Authorization/roleDefinitions"
627+
}
628+
```
629+
581630
## App Configuration Data Owner
582631

583632
Allows full access to App Configuration data.
@@ -666,6 +715,53 @@ Allows read access to App Configuration data.
666715
}
667716
```
668717

718+
## App Configuration Reader
719+
720+
Grants permission for read operations for App Configuration resources.
721+
722+
> [!div class="mx-tableFixed"]
723+
> | Actions | Description |
724+
> | --- | --- |
725+
> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/*/read | |
726+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
727+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/read | Read a classic metric alert |
728+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
729+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
730+
> | **NotActions** | |
731+
> | *none* | |
732+
> | **DataActions** | |
733+
> | *none* | |
734+
> | **NotDataActions** | |
735+
> | *none* | |
736+
737+
```json
738+
{
739+
"assignableScopes": [
740+
"/"
741+
],
742+
"description": "Grants permission for read operations for App Configuration resources.",
743+
"id": "/providers/Microsoft.Authorization/roleDefinitions/175b81b9-6e0d-490a-85e4-0d422273c10c",
744+
"name": "175b81b9-6e0d-490a-85e4-0d422273c10c",
745+
"permissions": [
746+
{
747+
"actions": [
748+
"Microsoft.AppConfiguration/*/read",
749+
"Microsoft.Authorization/*/read",
750+
"Microsoft.Insights/alertRules/read",
751+
"Microsoft.Resources/deployments/read",
752+
"Microsoft.Resources/subscriptions/resourceGroups/read"
753+
],
754+
"notActions": [],
755+
"dataActions": [],
756+
"notDataActions": []
757+
}
758+
],
759+
"roleName": "App Configuration Reader",
760+
"roleType": "BuiltInRole",
761+
"type": "Microsoft.Authorization/roleDefinitions"
762+
}
763+
```
764+
669765
## Azure API Center Compliance Manager
670766

671767
Allows managing API compliance in Azure API Center service.

0 commit comments

Comments
 (0)