|
1 |
| ---- |
2 |
| -title: include file |
3 |
| -description: include file |
4 |
| -author: terencefan |
5 |
| -ms.service: azure-signalr-service |
6 |
| -ms.topic: include |
7 |
| -ms.date: 03/12/2025 |
8 |
| -ms.author: tefa |
9 |
| -ms.custom: include file |
10 |
| ---- |
11 |
| - |
12 |
| -The following steps describe how to assign a **SignalR App Server** role to a service principal or a managed identity for an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml). |
13 |
| - |
14 |
| -> [!NOTE] |
15 |
| -> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../../role-based-access-control/scope-overview.md). |
16 |
| -
|
17 |
| -1. In the [Azure portal](https://portal.azure.com/), go to your Azure SignalR Service resource. |
18 |
| - |
19 |
| -1. Select **Access control (IAM)** in the sidebar. |
20 |
| - |
21 |
| -1. Select **Add** > **Add role assignment**. |
22 |
| - |
23 |
| - :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment."::: |
24 |
| - |
25 |
| -1. On the **Role** tab, select **SignalR App Server** or other SignalR built-in roles depends on your scenario. |
26 |
| - |
27 |
| - | Role | Description | Use case | |
28 |
| - | ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | |
29 |
| - | [SignalR App Server](../../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. | |
30 |
| - | [SignalR Service Owner](../../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. | |
31 |
| - | [SignalR REST API Owner](../../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. | |
32 |
| - | [SignalR REST API Reader](../../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. | |
33 |
| - |
34 |
| -1. Select Next. |
35 |
| - |
36 |
| - |
37 |
| -1. For Microsoft Entra application. |
38 |
| - |
39 |
| - |
40 |
| - 1. In the `Assign access` to row, select **User, group, or service principal**. |
41 |
| - 1. In the `Members` row, click `select members`, then choose the identity in the pop-up window. |
42 |
| - |
43 |
| -1. For managed identity for Azure resources. |
44 |
| - |
45 |
| - 1. In the `Assign access` to row, select **Managed identity**. |
46 |
| - 1. In the `Members` row, click `select members`, then choose the application in the pop-up window. |
47 |
| - |
48 |
| -1. Select Next. |
49 |
| - |
50 |
| - |
51 |
| -1. Review your assignment, then click **Review + assign** to confirm the role assignment. |
52 |
| - |
53 |
| -> [!IMPORTANT] |
54 |
| -> Newly added role assignments might take up to 30 minutes to propagate. |
55 |
| -
|
56 |
| -To learn more about how to assign and manage Azure roles, see these articles: |
57 |
| - |
58 |
| -- [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml) |
59 |
| -- [Assign Azure roles using the REST API](../../role-based-access-control/role-assignments-rest.md) |
60 |
| -- [Assign Azure roles using Azure PowerShell](../../role-based-access-control/role-assignments-powershell.md) |
61 |
| -- [Assign Azure roles using the Azure CLI](../../role-based-access-control/role-assignments-cli.md) |
| 1 | +--- |
| 2 | +title: include file |
| 3 | +description: include file |
| 4 | +author: terencefan |
| 5 | +ms.service: azure-signalr-service |
| 6 | +ms.topic: include |
| 7 | +ms.date: 03/12/2025 |
| 8 | +ms.author: tefa |
| 9 | +ms.custom: include file |
| 10 | +--- |
| 11 | + |
| 12 | +The following steps describe how to assign a **SignalR App Server** role to a service principal or a managed identity for an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml). |
| 13 | + |
| 14 | +> [!NOTE] |
| 15 | +> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../../role-based-access-control/scope-overview.md). |
| 16 | +
|
| 17 | +1. In the [Azure portal](https://portal.azure.com/), go to your Azure SignalR Service resource. |
| 18 | + |
| 19 | +1. Select **Access control (IAM)** in the sidebar. |
| 20 | + |
| 21 | +1. Select **Add** > **Add role assignment**. |
| 22 | + |
| 23 | + :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment."::: |
| 24 | + |
| 25 | +1. On the **Role** tab, select **SignalR App Server** or other SignalR built-in roles depends on your scenario. |
| 26 | + |
| 27 | + | Role | Description | Use case | |
| 28 | + | ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | |
| 29 | + | [SignalR App Server](../../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. | |
| 30 | + | [SignalR Service Owner](../../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. | |
| 31 | + | [SignalR REST API Owner](../../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. | |
| 32 | + | [SignalR REST API Reader](../../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. | |
| 33 | + |
| 34 | +1. Select Next. |
| 35 | + |
| 36 | + |
| 37 | +1. For Microsoft Entra application. |
| 38 | + |
| 39 | + |
| 40 | + 1. In the `Assign access` to row, select **User, group, or service principal**. |
| 41 | + 1. In the `Members` row, click `select members`, then choose the identity in the pop-up window. |
| 42 | + |
| 43 | +1. For managed identity for Azure resources. |
| 44 | + |
| 45 | + 1. In the `Assign access` to row, select **Managed identity**. |
| 46 | + 1. In the `Members` row, click `select members`, then choose the application in the pop-up window. |
| 47 | + |
| 48 | +1. Select Next. |
| 49 | + |
| 50 | + |
| 51 | +1. Review your assignment, then click **Review + assign** to confirm the role assignment. |
| 52 | + |
| 53 | +> [!IMPORTANT] |
| 54 | +> Newly added role assignments might take up to 30 minutes to propagate. |
| 55 | +
|
| 56 | +To learn more about how to assign and manage Azure roles, see these articles: |
| 57 | + |
| 58 | +- [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml) |
| 59 | +- [Assign Azure roles using the REST API](../../role-based-access-control/role-assignments-rest.md) |
| 60 | +- [Assign Azure roles using Azure PowerShell](../../role-based-access-control/role-assignments-powershell.md) |
| 61 | +- [Assign Azure roles using the Azure CLI](../../role-based-access-control/role-assignments-cli.md) |
62 | 62 | - [Assign Azure roles using Azure Resource Manager templates](../../role-based-access-control/role-assignments-template.md)
|
0 commit comments