Skip to content

Commit 7804959

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #271389 from rolyon/rolyon-rbac-roles-scheduled-patching-contributor
[Azure RBAC] Scheduled Patching Contributor and Microsoft.Maintenance
2 parents 3cc047f + 3da6915 commit 7804959

File tree

4 files changed

+91
-0
lines changed

4 files changed

+91
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -418,6 +418,7 @@ The following table provides a brief description of each built-in role. Click th
418418
> | <a name='reservations-administrator'></a>[Reservations Administrator](./built-in-roles/management-and-governance.md#reservations-administrator) | Lets one read and manage all the reservations in a tenant | a8889054-8d42-49c9-bc1c-52486c10e7cd |
419419
> | <a name='reservations-reader'></a>[Reservations Reader](./built-in-roles/management-and-governance.md#reservations-reader) | Lets one read all the reservations in a tenant | 582fc458-8989-419f-a480-75249bc5db7e |
420420
> | <a name='resource-policy-contributor'></a>[Resource Policy Contributor](./built-in-roles/management-and-governance.md#resource-policy-contributor) | Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy. | 36243c78-bf99-498c-9df9-86d9f8d28608 |
421+
> | <a name='scheduled-patching-contributor'></a>[Scheduled Patching Contributor](./built-in-roles/management-and-governance.md#scheduled-patching-contributor) | Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments | cd08ab90-6b14-449c-ad9a-8f8e549482c6 |
421422
> | <a name='site-recovery-contributor'></a>[Site Recovery Contributor](./built-in-roles/management-and-governance.md#site-recovery-contributor) | Lets you manage Site Recovery service except vault creation and role assignment | 6670b86e-a3f7-4917-ac9b-5d6ab1be4567 |
422423
> | <a name='site-recovery-operator'></a>[Site Recovery Operator](./built-in-roles/management-and-governance.md#site-recovery-operator) | Lets you failover and failback but not perform other Site Recovery management operations | 494ae006-db33-4328-bf46-533a6560a3ca |
423424
> | <a name='site-recovery-reader'></a>[Site Recovery Reader](./built-in-roles/management-and-governance.md#site-recovery-reader) | Lets you view Site Recovery status but not perform other management operations | dbaa88c4-0c30-4179-9fb3-46319faa6149 |

‎articles/role-based-access-control/built-in-roles/management-and-governance.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1471,6 +1471,69 @@ Users with rights to create/modify resource policy, create support ticket and re
14711471
}
14721472
```
14731473

1474+
## Scheduled Patching Contributor
1475+
1476+
Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments
1477+
1478+
[Learn more](/azure/update-manager/scheduled-patching)
1479+
1480+
> [!div class="mx-tableFixed"]
1481+
> | Actions | Description |
1482+
> | --- | --- |
1483+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/maintenanceConfigurations/read | Read maintenance configuration. |
1484+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/maintenanceConfigurations/write | Create or update maintenance configuration. |
1485+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/maintenanceConfigurations/delete | Delete maintenance configuration. |
1486+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/configurationAssignments/read | Read maintenance configuration assignment. |
1487+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/configurationAssignments/write | Create or update maintenance configuration assignment. |
1488+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/configurationAssignments/delete | Delete maintenance configuration assignment. |
1489+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/configurationAssignments/maintenanceScope/InGuestPatch/read | Read maintenance configuration assignment for InGuestPatch maintenance scope. |
1490+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/configurationAssignments/maintenanceScope/InGuestPatch/write | Create or update a maintenance configuration assignment for InGuestPatch maintenance scope. |
1491+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/configurationAssignments/maintenanceScope/InGuestPatch/delete | Delete maintenance configuration assignment for InGuestPatch maintenance scope. |
1492+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/maintenanceConfigurations/maintenanceScope/InGuestPatch/read | Read maintenance configuration for InGuestPatch maintenance scope. |
1493+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/maintenanceConfigurations/maintenanceScope/InGuestPatch/write | Create or update a maintenance configuration for InGuestPatch maintenance scope. |
1494+
> | [Microsoft.Maintenance](../permissions/management-and-governance.md#microsoftmaintenance)/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete | Delete maintenance configuration for InGuestPatch maintenance scope. |
1495+
> | **NotActions** | |
1496+
> | *none* | |
1497+
> | **DataActions** | |
1498+
> | *none* | |
1499+
> | **NotDataActions** | |
1500+
> | *none* | |
1501+
1502+
```json
1503+
{
1504+
"assignableScopes": [
1505+
"/"
1506+
],
1507+
"description": "Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments",
1508+
"id": "/providers/Microsoft.Authorization/roleDefinitions/cd08ab90-6b14-449c-ad9a-8f8e549482c6",
1509+
"name": "cd08ab90-6b14-449c-ad9a-8f8e549482c6",
1510+
"permissions": [
1511+
{
1512+
"actions": [
1513+
"Microsoft.Maintenance/maintenanceConfigurations/read",
1514+
"Microsoft.Maintenance/maintenanceConfigurations/write",
1515+
"Microsoft.Maintenance/maintenanceConfigurations/delete",
1516+
"Microsoft.Maintenance/configurationAssignments/read",
1517+
"Microsoft.Maintenance/configurationAssignments/write",
1518+
"Microsoft.Maintenance/configurationAssignments/delete",
1519+
"Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read",
1520+
"Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write",
1521+
"Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete",
1522+
"Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read",
1523+
"Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write",
1524+
"Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete"
1525+
],
1526+
"notActions": [],
1527+
"dataActions": [],
1528+
"notDataActions": []
1529+
}
1530+
],
1531+
"roleName": "Scheduled Patching Contributor",
1532+
"roleType": "BuiltInRole",
1533+
"type": "Microsoft.Authorization/roleDefinitions"
1534+
}
1535+
```
1536+
14741537
## Site Recovery Contributor
14751538

14761539
Lets you manage Site Recovery service except vault creation and role assignment

‎articles/role-based-access-control/permissions/management-and-governance.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,32 @@ Azure service: Microsoft Monitoring Insights
604604
> | Microsoft.Intune/diagnosticsettings/delete | Deleting a diagnostic setting |
605605
> | Microsoft.Intune/diagnosticsettingscategories/read | Reading a diagnostic setting categories |
606606
607+
## Microsoft.Maintenance
608+
609+
Azure service: [Azure Maintenance](/azure/virtual-machines/maintenance-configurations), [Azure Update Manager](/azure/update-manager/overview)
610+
611+
> [!div class="mx-tableFixed"]
612+
> | Action | Description |
613+
> | --- | --- |
614+
> | Microsoft.Maintenance/applyUpdates/write | Write apply updates to a resource. |
615+
> | Microsoft.Maintenance/applyUpdates/read | Read apply updates to a resource. |
616+
> | Microsoft.Maintenance/configurationAssignments/write | Create or update maintenance configuration assignment. |
617+
> | Microsoft.Maintenance/configurationAssignments/read | Read maintenance configuration assignment. |
618+
> | Microsoft.Maintenance/configurationAssignments/delete | Delete maintenance configuration assignment. |
619+
> | Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write | Create or update a maintenance configuration assignment for InGuestPatch maintenance scope. |
620+
> | Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read | Read maintenance configuration assignment for InGuestPatch maintenance scope. |
621+
> | Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete | Delete maintenance configuration assignment for InGuestPatch maintenance scope. |
622+
> | Microsoft.Maintenance/maintenanceConfigurations/write | Create or update maintenance configuration. |
623+
> | Microsoft.Maintenance/maintenanceConfigurations/read | Read maintenance configuration. |
624+
> | Microsoft.Maintenance/maintenanceConfigurations/delete | Delete maintenance configuration. |
625+
> | Microsoft.Maintenance/maintenanceConfigurations/eventGridFilters/delete | Notifies Microsoft.Maintenance that an EventGrid Subscription for Maintenance Configuration is being deleted. |
626+
> | Microsoft.Maintenance/maintenanceConfigurations/eventGridFilters/read | Notifies Microsoft.Maintenance that an EventGrid Subscription for Maintenance Configuration is being viewed. |
627+
> | Microsoft.Maintenance/maintenanceConfigurations/eventGridFilters/write | Notifies Microsoft.Maintenance that a new EventGrid Subscription for Maintenance Configuration is being created. |
628+
> | Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write | Create or update a maintenance configuration for InGuestPatch maintenance scope. |
629+
> | Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read | Read maintenance configuration for InGuestPatch maintenance scope. |
630+
> | Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete | Delete maintenance configuration for InGuestPatch maintenance scope. |
631+
> | Microsoft.Maintenance/updates/read | Read updates to a resource. |
632+
607633
## Microsoft.ManagedServices
608634

609635
Azure service: [Azure Lighthouse](/azure/lighthouse/)

‎articles/role-based-access-control/resource-provider-operations.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,7 @@ Click the resource provider name in the following list to see the list of permis
275275
> | [Microsoft.Features](./permissions/management-and-governance.md#microsoftfeatures) | | [Azure Resource Manager](/azure/azure-resource-manager/) |
276276
> | [Microsoft.GuestConfiguration](./permissions/management-and-governance.md#microsoftguestconfiguration) | Audit settings inside a machine using Azure Policy. | [Azure Policy](/azure/governance/policy/) |
277277
> | [Microsoft.Intune](./permissions/management-and-governance.md#microsoftintune) | Enable your workforce to be productive on all their devices, while keeping your organization's information protected. | |
278+
> | [Microsoft.Maintenance](./permissions/management-and-governance.md#microsoftmaintenance) | | [Azure Maintenance](/azure/virtual-machines/maintenance-configurations)<br/>[Azure Update Manager](/azure/update-manager/overview) |
278279
> | [Microsoft.ManagedServices](./permissions/management-and-governance.md#microsoftmanagedservices) | | [Azure Lighthouse](/azure/lighthouse/) |
279280
> | [Microsoft.Management](./permissions/management-and-governance.md#microsoftmanagement) | Use management groups to efficiently apply governance controls and manage groups of Azure subscriptions. | [Management Groups](/azure/governance/management-groups/) |
280281
> | [Microsoft.PolicyInsights](./permissions/management-and-governance.md#microsoftpolicyinsights) | Summarize policy states for the subscription level policy definition. | [Azure Policy](/azure/governance/policy/) |

0 commit comments

Comments
 (0)