Skip to content

Commit 7204ec1

Browse files
dominicbettsdominicbetts
committed
Add custom RBAC
1 parent b0640cd commit 7204ec1

File tree

2 files changed

+125
-0
lines changed

2 files changed

+125
-0
lines changed

‎articles/iot-operations/secure-iot-ops/howto-custom-rbac.md

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
title: Configure RBAC on your resources
3+
description: Use the Azure portal or CLI to secure access to Azure IoT Operations resources such as dataflows and assets by using Azure role-based access control.
4+
author: dominicbetts
5+
ms.author: dobett
6+
ms.topic: how-to
7+
ms.date: 04/10/2025
8+
9+
#CustomerIntent: As an IT administrator, I want configure Azure RBAC on resources in my Azure IoT Operations instance to control access to them.
10+
---
11+
12+
# Configure RBAC
13+
14+
To manage access to Azure IoT Operations resources such as assets and data flows, you can use Azure role-based access control (RBAC). Azure RBAC is an authorization system that enables you to manage access to Azure resources. You can use Azure RBAC to grant permissions to users, groups, and applications at a scope such as a subscription or resource group.
15+
16+
This article describes how you can create custom roles for Azure IoT Operations and assign them to users. You can use some or all of the example [custom roles](#list-of-custom-roles) in your environment
17+
18+
For example, you can assign a user the **Data Flow Administrator** custom role in a specific resource group. This role allows the user to create and manage data flows in the resource group. For another user, you can assign the **Data Flow Viewer** custom role in the same resource group. This role allows the user to view data flows but not create or manage them.
19+
20+
You can assign custom roles at either the subscription or resource group level. Assigning roles at the level of a resource group enables the most granular control.
21+
22+
> [!NOTE]
23+
> The Assets Endpoint Administrator and Data Flow Endpoint Administrator roles have access to Azure Key Vault. However, even if these custom roles are assigned at the subscription level, users can only see the list of key vaults from the specific resource group. Access to schema registries is also restricted to the resource group level.
24+
25+
To learn more about Azure RBAC, see [What is Azure role-based access control (Azure RBAC)?](/azure/role-based-access-control/overview).
26+
27+
## Create custom role definitions
28+
29+
To prepare one of the sample custom roles:
30+
31+
1. Download the [JSON file for the custom role](#create-custom-role-definitions) you want to create. The JSON file contains the role definition, including the permissions and scope for the role.
32+
33+
1. Edit the JSON file to replace the placeholder value in the `assignableScopes` field with your subscription ID. Save your changes.
34+
35+
To add the custom role to your Azure subscription using the Azure portal:
36+
37+
1. Go to your subscription in the Azure portal.
38+
39+
1. Select **Access control (IAM)**.
40+
41+
1. Select **Add > Add custom role**.
42+
43+
1. Enter a name, such as **Data flow administrator**, and a description for the role.
44+
45+
1. Select **Start from JSON** and then select the JSON file you downloaded. The custom role name and description are populated from the file.
46+
47+
1. Optionally, review the permissions and assignable scopes.
48+
49+
1. To add the custom role to your subscription, select **Review + create** and then **Create**.
50+
51+
To add the custom role to your Azure subscription using the Azure CLI:
52+
53+
1. Open a command prompt and log in to your Azure account using the `az login` command.
54+
55+
1. The following command shows how to create the **Data flow administrator** custom role:
56+
57+
```console
58+
az role definition create --role-definition "Data Flow Administrator.json"
59+
```
60+
61+
## Assign roles
62+
63+
After you create the custom roles in your subscription, you can assign them to users, groups, or applications. You can assign roles at the subscription or resource group level.
64+
65+
To assign the custom role to a user at the resource group level using the Azure portal:
66+
67+
1. Go to your resource group in the Azure portal.
68+
69+
1. Select **Access control (IAM)**.
70+
71+
1. Select **Add > Add role assignment**.
72+
73+
1. Search for and select the custom role you want to assign. Select **Next**.
74+
75+
1. Select the user or users you want to assign the role to. You can search for users by name or email address.
76+
77+
1. Select **Review + assign** to review the role assignment. If everything looks good, select **Assign**.
78+
79+
To create a role assignment at the resource group level using the Azure CLI:
80+
81+
1. Open a command prompt and log in to your Azure account using the `az login` command.
82+
83+
1. The following command shows how to assign a user to the **Data flow administrator** custom role:
84+
85+
```console
86+
az role assignment create --assignee "<User to assign>" \
87+
--role "Data flow administrator" \
88+
--scope "/subscriptions/<Your subscription Id>/resourceGroups/<Your resource group name>"
89+
```
90+
91+
## List of custom roles
92+
93+
The following sections list the example Azure IoT Operations custom roles you can download and use:
94+
95+
### Onboarding roles
96+
97+
| Custom role | Description |
98+
| ----------- | ----------- |
99+
| [Onboarding](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Onboarding.json) | This is privileged role. The user can complete Azure Arc connect process and deploy Azure IoT Operations securely. |
100+
101+
### Viewer roles
102+
103+
| Custom role | Description |
104+
| ----------- | ----------- |
105+
| [Instance viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Instance%20Viewer.json) | This role allows the user to view the Azure IoT Operations instance. |
106+
| [Asset viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Asset%20Viewer.json) | This role allows the user to view the assets in the Azure IoT Operations instance. |
107+
| [Asset endpoint viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Asset%20Endpoint%20Viewer.json) | This role allows the user to view the asset endpoints in the Azure IoT Operations instance. |
108+
| [Data flow viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Data%20Flow%20Viewer.json) | This role allows the user to view the data flows in the Azure IoT Operations instance. |
109+
| [Data flow destination viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Data%20Flow%20Destination%20Viewer.json) | This role allows the user to view the data flow destinations in the Azure IoT Operations instance. |
110+
| [MQ viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/MQ%20Viewer.json) | This role allows the user to view the MQTT broker in the Azure IoT Operations instance. |
111+
| [Viewer](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Viewer.json) | This role allows the user to view the Azure IoT Operations instance. This role is a combination of the **Instance viewer**, **Asset viewer**, **Asset endpoint viewer**, **Data flow viewer**, **Data flow destination viewer**, and **MQ viewer** roles. |
112+
113+
### Administrator roles
114+
115+
| Custom role | Description |
116+
| ----------- | ----------- |
117+
| [Instance administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Instance%20Administrator.json) | The user can deploy an instance. The role includes permissions to create and update instances, brokers, authentications, listeners, dataflow profiles, dataflow endpoints, schema registries, and user assigned identities. The role also incudes permission to delete instances. |
118+
| [Asset administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Asset%20Administrator.json) | The user can create and manage assets in the Azure IoT Operations instance. |
119+
| [Asset endpoint administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Asset%20Endpoint%20Administrator.json) | The user can create and manage asset endpoints in the Azure IoT Operations instance. |
120+
| [Data flow administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Data%20Flow%20Administrator.json) | The user can create and manage data flows in the Azure IoT Operations instance. |
121+
| [Data flow destination administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Data%20Flow%20Destination%20Administrator.json) | The user can create and manage data flow destinations in the Azure IoT Operations instance. |
122+
| [MQ administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/MQ%20Administrator.json) | The user can create and manage the MQTT broker in the Azure IoT Operations instance. |
123+
| [Administrator](https://github.com/Azure-Samples/explore-iot-operations/blob/main/samples/custom-rbac/Administrator.json) | The user can create and manage the Azure IoT Operations instance. This role is a combination of the **Instance administrator**, **Asset administrator**, **Asset endpoint administrator**, **Data flow administrator**, **Data flow destination administrator**, and **MQ administrator** roles. |

‎articles/iot-operations/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ items:
3939
href: secure-iot-ops/howto-manage-secrets.md
4040
- name: Validate images
4141
href: secure-iot-ops/howto-validate-images.md
42+
- name: Configure RBAC
43+
href: secure-iot-ops/howto-custom-rbac.md
4244
- name: Secure your solution
4345
href: ../iot/iot-overview-security.md
4446
- name: Discover and manage assets

0 commit comments

Comments
 (0)