Skip to content

Commit 7fc318c

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #210726 from rolyon/rolyon-rbac-roles-template-spec
[Azure RBAC] Template Spec
2 parents 25b6297 + aeaf546 commit 7fc318c

File tree

2 files changed

+227
-105
lines changed

2 files changed

+227
-105
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 101 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.workload: identity
88
author: rolyon
99
manager: amycolannino
1010
ms.author: rolyon
11-
ms.date: 08/20/2022
11+
ms.date: 09/09/2022
1212
ms.custom: generated
1313
---
1414

@@ -271,6 +271,8 @@ The following table provides a brief description of each built-in role. Click th
271271
> | [Site Recovery Reader](#site-recovery-reader) | Lets you view Site Recovery status but not perform other management operations | dbaa88c4-0c30-4179-9fb3-46319faa6149 |
272272
> | [Support Request Contributor](#support-request-contributor) | Lets you create and manage Support requests | cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e |
273273
> | [Tag Contributor](#tag-contributor) | Lets you manage tags on entities, without providing access to the entities themselves. | 4a9ae827-6dc8-4573-8ac7-8239d42aa03f |
274+
> | [Template Spec Contributor](#template-spec-contributor) | Allows full access to Template Spec operations at the assigned scope. | 1c9b6475-caf0-4164-b5a1-2142a7116f4b |
275+
> | [Template Spec Reader](#template-spec-reader) | Allows read access to Template Specs at the assigned scope. | 392ae280-861d-42bd-9ea5-08ee6d83b80e |
274276
> | **Virtual desktop infrastructure** | | |
275277
> | [Desktop Virtualization Application Group Contributor](#desktop-virtualization-application-group-contributor) | Contributor of the Desktop Virtualization Application Group. | 86240b0e-9422-4c43-887b-b61143f32ba8 |
276278
> | [Desktop Virtualization Application Group Reader](#desktop-virtualization-application-group-reader) | Reader of the Desktop Virtualization Application Group. | aebf23d0-b568-4e86-b8f9-fe83a2c6ab55 |
@@ -4299,6 +4301,7 @@ Manage the web plans for websites. Does not allow you to assign roles in Azure R
42994301
> | [Microsoft.Support](resource-provider-operations.md#microsoftsupport)/* | Create and update a support ticket |
43004302
> | [Microsoft.Web](resource-provider-operations.md#microsoftweb)/serverFarms/* | Create and manage server farms |
43014303
> | [Microsoft.Web](resource-provider-operations.md#microsoftweb)/hostingEnvironments/Join/Action | Joins an App Service Environment |
4304+
> | [Microsoft.Insights](resource-provider-operations.md#microsoftinsights)/autoscalesettings/* | |
43024305
> | **NotActions** | |
43034306
> | *none* | |
43044307
> | **DataActions** | |
@@ -4324,7 +4327,8 @@ Manage the web plans for websites. Does not allow you to assign roles in Azure R
43244327
"Microsoft.Resources/subscriptions/resourceGroups/read",
43254328
"Microsoft.Support/*",
43264329
"Microsoft.Web/serverFarms/*",
4327-
"Microsoft.Web/hostingEnvironments/Join/Action"
4330+
"Microsoft.Web/hostingEnvironments/Join/Action",
4331+
"Microsoft.Insights/autoscalesettings/*"
43284332
],
43294333
"notActions": [],
43304334
"dataActions": [],
@@ -10338,7 +10342,7 @@ Microsoft Sentinel Reader [Learn more](../sentinel/roles.md)
1033810342
> | [Microsoft.Insights](resource-provider-operations.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
1033910343
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/deployments/* | Create and manage a deployment |
1034010344
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
10341-
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/templateSpecs/*/read | |
10345+
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/templateSpecs/*/read | Get or list template specs and template spec versions |
1034210346
> | [Microsoft.Support](resource-provider-operations.md#microsoftsupport)/* | Create and update a support ticket |
1034310347
> | **NotActions** | |
1034410348
> | [Microsoft.SecurityInsights](resource-provider-operations.md#microsoftsecurityinsights)/ConfidentialWatchlists/* | |
@@ -11061,7 +11065,7 @@ Can read all monitoring data and edit monitoring settings. See also [Get started
1106111065
> | **NotActions** | |
1106211066
> | *none* | |
1106311067
> | **DataActions** | |
11064-
> | [microsoft.monitor](resource-provider-operations.md#microsoftmonitor)/accounts/data/metrics/read | Read metrics data in any Monitoring Account |
11068+
> | *none* | |
1106511069
> | **NotDataActions** | |
1106611070
> | *none* | |
1106711071

@@ -11115,9 +11119,7 @@ Can read all monitoring data and edit monitoring settings. See also [Get started
1111511119
"Microsoft.AlertsManagement/migrateFromSmartDetection/*"
1111611120
],
1111711121
"notActions": [],
11118-
"dataActions": [
11119-
"microsoft.monitor/accounts/data/metrics/read"
11120-
],
11122+
"dataActions": [],
1112111123
"notDataActions": []
1112211124
}
1112311125
],
@@ -11187,7 +11189,7 @@ Can read all monitoring data (metrics, logs, etc.). See also [Get started with r
1118711189
> | **NotActions** | |
1118811190
> | *none* | |
1118911191
> | **DataActions** | |
11190-
> | [Microsoft.Monitor](resource-provider-operations.md#microsoftmonitor)/accounts/data/metrics/read | Read metrics data in any Monitoring Account |
11192+
> | *none* | |
1119111193
> | **NotDataActions** | |
1119211194
> | *none* | |
1119311195

@@ -11207,9 +11209,7 @@ Can read all monitoring data (metrics, logs, etc.). See also [Get started with r
1120711209
"Microsoft.Support/*"
1120811210
],
1120911211
"notActions": [],
11210-
"dataActions": [
11211-
"Microsoft.Monitor/accounts/data/metrics/read"
11212-
],
11212+
"dataActions": [],
1121311213
"notDataActions": []
1121411214
}
1121511215
],
@@ -13495,6 +13495,90 @@ Lets you manage tags on entities, without providing access to the entities thems
1349513495
}
1349613496
```
1349713497

13498+
### Template Spec Contributor
13499+
13500+
Allows full access to Template Spec operations at the assigned scope.
13501+
13502+
> [!div class="mx-tableFixed"]
13503+
> | Actions | Description |
13504+
> | --- | --- |
13505+
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/templateSpecs/* | Create and manage template specs and template spec versions |
13506+
> | [Microsoft.Authorization](resource-provider-operations.md#microsoftauthorization)/*/read | Read roles and role assignments |
13507+
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/deployments/* | Create and manage a deployment |
13508+
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
13509+
> | **NotActions** | |
13510+
> | *none* | |
13511+
> | **DataActions** | |
13512+
> | *none* | |
13513+
> | **NotDataActions** | |
13514+
> | *none* | |
13515+
13516+
```json
13517+
{
13518+
"assignableScopes": [
13519+
"/"
13520+
],
13521+
"description": "Allows full access to Template Spec operations at the assigned scope.",
13522+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/1c9b6475-caf0-4164-b5a1-2142a7116f4b",
13523+
"name": "1c9b6475-caf0-4164-b5a1-2142a7116f4b",
13524+
"permissions": [
13525+
{
13526+
"actions": [
13527+
"Microsoft.Resources/templateSpecs/*",
13528+
"Microsoft.Authorization/*/read",
13529+
"Microsoft.Resources/deployments/*",
13530+
"Microsoft.Resources/subscriptions/resourceGroups/read"
13531+
],
13532+
"notActions": [],
13533+
"dataActions": [],
13534+
"notDataActions": []
13535+
}
13536+
],
13537+
"roleName": "Template Spec Contributor",
13538+
"roleType": "BuiltInRole",
13539+
"type": "Microsoft.Authorization/roleDefinitions"
13540+
}
13541+
```
13542+
13543+
### Template Spec Reader
13544+
13545+
Allows read access to Template Specs at the assigned scope.
13546+
13547+
> [!div class="mx-tableFixed"]
13548+
> | Actions | Description |
13549+
> | --- | --- |
13550+
> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/templateSpecs/*/read | Get or list template specs and template spec versions |
13551+
> | **NotActions** | |
13552+
> | *none* | |
13553+
> | **DataActions** | |
13554+
> | *none* | |
13555+
> | **NotDataActions** | |
13556+
> | *none* | |
13557+
13558+
```json
13559+
{
13560+
"assignableScopes": [
13561+
"/"
13562+
],
13563+
"description": "Allows read access to Template Specs at the assigned scope.",
13564+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/392ae280-861d-42bd-9ea5-08ee6d83b80e",
13565+
"name": "392ae280-861d-42bd-9ea5-08ee6d83b80e",
13566+
"permissions": [
13567+
{
13568+
"actions": [
13569+
"Microsoft.Resources/templateSpecs/*/read"
13570+
],
13571+
"notActions": [],
13572+
"dataActions": [],
13573+
"notDataActions": []
13574+
}
13575+
],
13576+
"roleName": "Template Spec Reader",
13577+
"roleType": "BuiltInRole",
13578+
"type": "Microsoft.Authorization/roleDefinitions"
13579+
}
13580+
```
13581+
1349813582
## Virtual desktop infrastructure
1349913583

1350013584

@@ -14063,10 +14147,11 @@ Full access role for Digital Twins data-plane [Learn more](../digital-twins/conc
1406314147
> | **NotActions** | |
1406414148
> | *none* | |
1406514149
> | **DataActions** | |
14066-
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/eventroutes/* | Read, delete, create, or update any Event Route |
1406714150
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/digitaltwins/* | Read, create, update, or delete any Digital Twin |
1406814151
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/digitaltwins/commands/* | Invoke any Command on a Digital Twin |
1406914152
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/digitaltwins/relationships/* | Read, create, update, or delete any Digital Twin Relationship |
14153+
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/eventroutes/* | Read, delete, create, or update any Event Route |
14154+
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/jobs/* | |
1407014155
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/models/* | Read, create, update, or delete any Model |
1407114156
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/query/* | Query any Digital Twins Graph |
1407214157
> | **NotDataActions** | |
@@ -14085,10 +14170,11 @@ Full access role for Digital Twins data-plane [Learn more](../digital-twins/conc
1408514170
"actions": [],
1408614171
"notActions": [],
1408714172
"dataActions": [
14088-
"Microsoft.DigitalTwins/eventroutes/*",
1408914173
"Microsoft.DigitalTwins/digitaltwins/*",
1409014174
"Microsoft.DigitalTwins/digitaltwins/commands/*",
1409114175
"Microsoft.DigitalTwins/digitaltwins/relationships/*",
14176+
"Microsoft.DigitalTwins/eventroutes/*",
14177+
"Microsoft.DigitalTwins/jobs/*",
1409214178
"Microsoft.DigitalTwins/models/*",
1409314179
"Microsoft.DigitalTwins/query/*"
1409414180
],
@@ -14115,6 +14201,7 @@ Read-only role for Digital Twins data-plane properties [Learn more](../digital-t
1411514201
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/digitaltwins/read | Read any Digital Twin |
1411614202
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/digitaltwins/relationships/read | Read any Digital Twin Relationship |
1411714203
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/eventroutes/read | Read any Event Route |
14204+
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/jobs/import/read | Read any Bulk Import Job |
1411814205
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/models/read | Read any Model |
1411914206
> | [Microsoft.DigitalTwins](resource-provider-operations.md#microsoftdigitaltwins)/query/action | Query any Digital Twins Graph |
1412014207
> | **NotDataActions** | |
@@ -14136,6 +14223,7 @@ Read-only role for Digital Twins data-plane properties [Learn more](../digital-t
1413614223
"Microsoft.DigitalTwins/digitaltwins/read",
1413714224
"Microsoft.DigitalTwins/digitaltwins/relationships/read",
1413814225
"Microsoft.DigitalTwins/eventroutes/read",
14226+
"Microsoft.DigitalTwins/jobs/import/read",
1413914227
"Microsoft.DigitalTwins/models/read",
1414014228
"Microsoft.DigitalTwins/query/action"
1414114229
],

0 commit comments

Comments
 (0)