Skip to content

Commit 759a4b0

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #301103 from codefinite-vri/main
Update Azure File Sync Administrator and Azure File Sync Reader Built-in roles.
2 parents d4af92d + 9114eae commit 759a4b0

File tree

4 files changed

+112
-5
lines changed

4 files changed

+112
-5
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,8 @@ The following table provides a brief description of each built-in role. Click th
106106
> | --- | --- | --- |
107107
> | <a name='avere-contributor'></a>[Avere Contributor](./built-in-roles/storage.md#avere-contributor) | Can create and manage an Avere vFXT cluster. | 4f8fab4f-1852-4a58-a46a-8eaf358af14a |
108108
> | <a name='avere-operator'></a>[Avere Operator](./built-in-roles/storage.md#avere-operator) | Used by the Avere vFXT cluster to manage the cluster | c025889f-8102-4ebf-b32c-fc0c6f0c6bd9 |
109+
> | <a name='azure-file-sync-administrator'></a>[Azure File Sync Administrator](./built-in-roles/storage.md#azure-file-sync-administrator) | Provides full access to manage all Azure File Sync (Storage Sync Service) resources, including the ability to assign roles in Azure RBAC. | 92b92042-07d9-4307-87f7-36a593fc5850 |
110+
> | <a name='azure-file-sync-reader'></a>[Azure File Sync Reader](./built-in-roles/storage.md#azure-file-sync-reader) | Provides read access to Azure File Sync service (Storage Sync Service). | 754c1a27-40dc-4708-8ad4-2bffdeee09e8 |
109111
> | <a name='backup-contributor'></a>[Backup Contributor](./built-in-roles/storage.md#backup-contributor) | Lets you manage backup service, but can't create vaults and give access to others | 5e467623-bb1f-42f4-a55d-6e525e11384b |
110112
> | <a name='backup-mua-admin'></a>[Backup MUA Admin](./built-in-roles/storage.md#backup-mua-admin) | Backup MultiUser-Authorization. Can create/delete ResourceGuard | c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8 |
111113
> | <a name='backup-mua-operator'></a>[Backup MUA Operator](./built-in-roles/storage.md#backup-mua-operator) | Backup MultiUser-Authorization. Allows user to perform critical operation protected by resourceguard | f54b6d04-23c6-443e-b462-9c16ab7b4a52 |

‎articles/role-based-access-control/built-in-roles/storage.md

Lines changed: 106 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,112 @@ Used by the Avere vFXT cluster to manage the cluster
167167
"type": "Microsoft.Authorization/roleDefinitions"
168168
}
169169
```
170+
## Azure File Sync Administrator
170171

172+
This role provides full access to manage all Azure File Sync (Storage Sync Service) resources, including the ability to assign roles in Azure RBAC.
173+
174+
[Learn more](/azure/storage/file-sync/file-sync-deployment-guide)
175+
176+
> [!div class="mx-tableFixed"]
177+
> | Actions | Description |
178+
> | --- | --- |
179+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/register/action | Registers the server to Storage Sync Service |
180+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/unregister/action | Unregisters the server to Storage Sync Service |
181+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/locations/* | |
182+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/deployments/preflight/action | |
183+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/storageSyncServices/* | |
184+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/operations/read | Returns the status of Storage Sync operations |
185+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/* | Create and manage a classic metric alert |
186+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
187+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups |
188+
> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
189+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create and update role assignments |
190+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Read role assignments |
191+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account |
192+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/read | List file services |
193+
> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/shares/read | Get file share |
194+
> | **NotActions** | |
195+
> | *none* | |
196+
> | **DataActions** | |
197+
> | *none* | |
198+
> | **NotDataActions** | |
199+
> | *none* | |
200+
```json
201+
{
202+
"assignableScopes": [
203+
"/"
204+
],
205+
"description": "This role provides full access to manage all Azure File Sync (Storage Sync Service) resources, including the ability to assign roles in Azure RBAC.",
206+
"id": "/providers/Microsoft.Authorization/roleDefinitions/92b92042-07d9-4307-87f7-36a593fc5850",
207+
"name": "92b92042-07d9-4307-87f7-36a593fc5850",
208+
"permissions": [
209+
{
210+
"actions": [
211+
"Microsoft.StorageSync/register/action",
212+
"Microsoft.StorageSync/unregister/action",
213+
"Microsoft.StorageSync/locations/*",
214+
"Microsoft.StorageSync/deployments/preflight/action",
215+
"Microsoft.StorageSync/storageSyncServices/*",
216+
"Microsoft.StorageSync/operations/read",
217+
"Microsoft.Insights/AlertRules/*",
218+
"Microsoft.Resources/deployments/*",
219+
"Microsoft.Resources/subscriptions/resourceGroups/read",
220+
"Microsoft.Support/*",
221+
"Microsoft.Authorization/roleAssignments/write",
222+
"Microsoft.Authorization/roleAssignments/read",
223+
"Microsoft.Storage/storageAccounts/read",
224+
"Microsoft.Storage/storageAccounts/fileServices/read",
225+
"Microsoft.Storage/storageAccounts/fileServices/shares/read"
226+
],
227+
"notActions": [],
228+
"dataActions": [],
229+
"notDataActions": []
230+
}
231+
],
232+
"roleName": "Azure File Sync Administrator",
233+
"roleType": "BuiltInRole",
234+
"type": "Microsoft.Authorization/roleDefinitions"
235+
}
236+
```
237+
## Azure File Sync Reader
238+
239+
This role provides read access to Azure File Sync service (Storage Sync Service).
240+
241+
[Learn more](/azure/storage/file-sync/file-sync-deployment-guide)
242+
243+
> [!div class="mx-tableFixed"]
244+
> | Actions | Description |
245+
> | --- | --- |
246+
> | [Microsoft.StorageSync](../permissions/storage.md#microsoftstoragesync)/*/read | |
247+
> | **NotActions** | |
248+
> | *none* | |
249+
> | **DataActions** | |
250+
> | *none* | |
251+
> | **NotDataActions** | |
252+
> | *none* | |
253+
```json
254+
{
255+
"assignableScopes": [
256+
"/"
257+
],
258+
"description": "This role provides full access to manage all Azure File Sync (Storage Sync Service) resources, including the ability to assign roles in Azure RBAC.",
259+
"id": "/providers/Microsoft.Authorization/roleDefinitions/754c1a27-40dc-4708-8ad4-2bffdeee09e8",
260+
"name": "754c1a27-40dc-4708-8ad4-2bffdeee09e8",
261+
"permissions": [
262+
{
263+
"actions": [
264+
"Microsoft.StorageSync/*/read"
265+
],
266+
"notActions": [],
267+
"dataActions": [],
268+
"notDataActions": []
269+
}
270+
],
271+
"roleName": "Azure File Sync Reader",
272+
"roleType": "BuiltInRole",
273+
"type": "Microsoft.Authorization/roleDefinitions"
274+
}
275+
```
171276
## Backup Contributor
172277

173278
Lets you manage backup service, but can't create vaults and give access to others
@@ -2366,4 +2471,4 @@ Allows for read access to Azure Storage tables and entities
23662471

23672472
## Next steps
23682473

2369-
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)
2474+
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)

‎articles/storage/file-sync/file-sync-deployment-guide.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -356,7 +356,7 @@ Registering your Windows Server with a Storage Sync Service establishes a trust
356356
> [!NOTE]
357357
> Server registration uses your Azure credentials to create a trust relationship between the Storage Sync Service and your Windows Server. Subsequently, the server creates and uses its own identity that is valid as long as the server stays registered and the current Shared Access Signature (SAS) token is valid. A new SAS token can't be issued to the server once the server is unregistered, thus removing the server's ability to access your Azure file shares, stopping any sync.
358358
359-
The administrator registering the server must be a member of the management roles **Owner** or **Contributor** for the given Storage Sync Service. This can be configured under **Access Control (IAM)** in the Azure portal for the Storage Sync Service.
359+
The administrator registering the server must be a member of the management roles **Azure File Sync Administrator**, **Owner** or **Contributor** for the given Storage Sync Service. This can be configured under **Access Control (IAM)** in the Azure portal for the Storage Sync Service.
360360

361361
It's also possible to differentiate administrators able to register servers from those allowed to also configure sync in a Storage Sync Service. To do this, you must create a custom role where you list the administrators that are only allowed to register servers and give your custom role the following permissions:
362362

@@ -408,7 +408,7 @@ A cloud endpoint is a pointer to an Azure file share. All server endpoints will
408408
> [!IMPORTANT]
409409
> You can make changes to any cloud endpoint or server endpoint in the sync group and have your files synced to the other endpoints in the sync group. If you make a change to the cloud endpoint (Azure file share) directly, changes first need to be discovered by an Azure File Sync change detection job. A change detection job is initiated for a cloud endpoint only once every 24 hours. For more information, see [Azure Files frequently asked questions](../files/storage-files-faq.md?toc=/azure/storage/filesync/toc.json#afs-change-detection).
410410
411-
The administrator creating the cloud endpoint must be a member of the management role **Owner** for the storage account that contains the Azure file share the cloud endpoint is pointing to. Configure this under **Access Control (IAM)** in the Azure portal for the storage account.
411+
The administrator creating the cloud endpoint must be a member of the management role **Azure File Sync Administrator** or **Owner** for the storage account that contains the Azure file share the cloud endpoint is pointing to. Configure this under **Access Control (IAM)** in the Azure portal for the storage account.
412412

413413
# [Portal](#tab/azure-portal)
414414

‎articles/storage/file-sync/file-sync-managed-identities.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ To configure your Azure File Sync deployment to utilize system-assigned managed
2525
# [Portal](#tab/azure-portal)
2626
- **Azure File Sync agent version 20.0.0.0 or later** must be installed on the registered server.
2727

28-
- On your **storage accounts** used by Azure File Sync, you must be a **member of the Owner management role** or have `Microsoft.Authorization/roleassignments/write` permissions.
28+
- On your **storage accounts** used by Azure File Sync, you must be a **member of the Azure File Sync Administrator or Owner management role** or have “Microsoft.Authorization/roleassignments/write” permissions.
2929

3030
# [PowerShell](#tab/azure-powershell)
3131
- **Azure File Sync agent version 20.0.0.0 or later** must be installed on the registered server.
3232

33-
- On your **storage accounts** used by Azure File Sync, you must be a **member of the Owner management role** or have `Microsoft.Authorization/roleassignments/write` permissions.
33+
- On your **storage accounts** used by Azure File Sync, you must be a **member of the Azure File Sync Administrator or Owner management role** or have “Microsoft.Authorization/roleassignments/write” permissions.
3434

3535

3636

0 commit comments

Comments
 (0)