You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn about roles and permissions for a Virtual WAN Hub.
5
5
author: siddomala
6
6
ms.service: azure-virtual-wan
7
-
ms.topic: concept-article
7
+
ms.topic: conceptual
8
8
ms.date: 12/13/2024
9
9
ms.author: cherylmc
10
10
@@ -16,7 +16,8 @@ Because of this, it's essential to verify permissions on all involved resources
16
16
17
17
## Azure built-in roles
18
18
19
-
You can choose to assign [Azure built-in roles](../role-based-access-control/built-in-roles.md) to a user, group, service principal, or managed identity such as [Network contributor](../role-based-access-control/built-in-roles.md#network-contributor), which support all the required permissions for creating the gateway.
19
+
You can choose to assign [Azure built-in roles](../role-based-access-control/built-in-roles.md) to a user, group, service principal, or managed identity such as [Network contributor](../role-based-access-control/built-in-roles.md#network-contributor), which support all the required permissions for creating resources related to Virtual WAN.
20
+
20
21
For more information, see [Steps to assign an Azure role](../role-based-access-control/role-assignments-steps.md).
21
22
22
23
## Custom roles
@@ -25,16 +26,107 @@ If the [Azure built-in roles](../role-based-access-control/built-in-roles.md) do
25
26
Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.
26
27
For more information, see [Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role) .
27
28
28
-
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities operating the VPN gateway have the necessary permissions.
29
+
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities interacting with Virtual WAN have the necessary permissions.
29
30
To add any missing permissions listed here, see [Update a custom role](../role-based-access-control/custom-roles-portal.md#update-a-custom-role).
30
31
31
-
## Permissions
32
+
The following custom roles are a few example roles you can create in your tenant if you don't want to leverage more generic built-in roles such as Network Contributor or Contributor.
33
+
34
+
### Virtual WAN Administrator
35
+
36
+
The Virtual WAN Administrator role has the ability to perform all operations related to the Virtual Hub, including managing connections to Virtual WAN and configuring routing.
37
+
38
+
```
39
+
{
40
+
"Name": "Virtual WAN Administrator",
41
+
"IsCustom": true,
42
+
"Description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
Creating or updating Virtual WAN resources requires you to have the proper permission(s) to create that Virtual WAN resource type. In some scenarios, having permissions to create or update that resource type is sufficient. However, in many scenarios, updating a Virtual WAN resource that has a **reference** to another Azure resource requires you to have permissions over both the created resource **and** any referenced resources.
94
+
95
+
### Example 1
96
+
97
+
When a connection is created between a Virtual WAN hub and a spoke Virtual Network, Virtual WAN's control plane creates a Virutal Network peering between the Virtual WAN hub and your spoke Virtual Network. You can also specify the Virtual WAN route tables to which the Virtual Network connection is associating to or propagating to.
98
+
99
+
Therefore, to create a Virtual Network connection to the Virtual WAN hub, you must have the following permissions:
100
+
101
+
* Create a Hub Virtual Network connection (Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write)
102
+
* Create a Virtual Network peering with the spoke Virtual Network (Microsoft.Network/virtualNetworks/peer/action)
103
+
* Read the route table(s) that the Virtual Network connections are referencing (Microsoft.Network/virtualhubs/hubRouteTables/read)
32
104
33
-
When creating or updating the resources below, add the appropriate permissions from the following list:
105
+
If you want to associate an inbound or out-bound route map is associated with the Virtual Network connection, you need an additional permission:
106
+
107
+
* Read the route map(s) that is applied to the Virtual Network connection (Microsoft.Network/virtualHubs/routeMaps/read).
108
+
109
+
### Example 2
110
+
111
+
To create or modify routing intent, a routing intent resource is created with a reference to the next hop resources specified in the routing intent's routing policy. This means that to create or modify routing intent, you need permissions over any referenced Azure Firewall or Network Virtual Appliance resource(s).
112
+
113
+
If the next hop for a hub's private routing intent policy is a Network Virtual Appliance and the next hop for a hub's internet policy is an Azure Firewall, creating or updating a routing intent resource requires the following permisisons.
* Reference (read) the Network Virtual Appliance resource (Microsoft.Network/networkVirtualAppliances/read)
117
+
* Reference (read) the Azure Firewall resource (Microsoft.Network/azureFirewalls)
118
+
119
+
In this example, you do **not** need permissions to read Microsoft.Network/securityPartnerProviders resources because the routing intent configured does not reference a third-party security provider resource.
120
+
121
+
## Additional permissions required due to referenced resources
122
+
123
+
The following section describes the set of possible permisisons that are needed to create or modify Virtual WAN resources.
124
+
125
+
Depending on your Virtual WAN configuration, the user or service principal that is managing your Virtual WAN deploymentes may need all, a subset or none of the below permissions.
34
126
35
127
### Virtual hub resources
36
128
37
-
|Resource | Required Azure permissions |
129
+
|Resource | Required Azure permissions due to resource references |
NVAs (Network Virtual Appliances) in Virtual WAN are typically deployed through Azure managed applications or directly via NVA orchestration software. For more information on how to properly assign permissions to managed applications or NVA orchestration software, see instructions [here](https://aka.ms/nvadeployment).
65
158
66
-
|Resource | Required Azure permissions |
159
+
|Resource | Required Azure permissions due to resource references |
@@ -83,6 +176,12 @@ For more information, see [Scope levels](../role-based-access-control/scope-over
83
176
> [!NOTE]
84
177
> Allow sufficient time for [Azure Resource Manager cache](../role-based-access-control/troubleshooting.md) to refresh after role assignment changes.
85
178
179
+
## Permissions Error
180
+
181
+
If you see an error in the following format, then please make sure you have the above permissions properly configured.
182
+
183
+
Error Message Format: "The client with object id {} does not have authorization to perform action {} over scope {} or the scope is invalid. If access was recently granted, please refresh your credentials."
184
+
86
185
## Additional services
87
186
88
187
To view roles and permissions for other services, see the following links:
0 commit comments