Skip to content

Commit 859521d

Browse files
SnehaSudhirGSnehaSudhirG
committed
added new article, updated toc and fixed warnings
1 parent 8953b26 commit 859521d

File tree

5 files changed

+78
-3
lines changed

5 files changed

+78
-3
lines changed

‎articles/update-manager/configure-wu-agent.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ The Windows update client on Windows servers can get their patches from either o
6868
6969
### Edit the registry
7070
71-
If scheduled patching is configured on your machine using the Azure Update Manager, the Auto update on the client is disabled. To edit the registry and configure the setting, see [First party updates on Windows](support-matrix.md#first-party-updates-on-windows).
71+
If scheduled patching is configured on your machine using the Azure Update Manager, the Auto update on the client is disabled. To edit the registry and configure the setting, see [First party updates on Windows](support-matrix.md).
7272
7373
### Patching using group policy on Azure Update Manager
7474

‎articles/update-manager/prerequisites.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Refer [support matrix](support-matrix.md) to find out about updates and the upda
2323

2424
### Roles and permissions
2525

26-
To manage machines from Azure Update Manager, see roles and permissions.
26+
To manage machines from Azure Update Manager, see [roles and permissions](roles-permissions.md).
2727

2828
### VM extensions
2929

‎articles/update-manager/roles-permissions.md

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
title: Roles and permissions in Azure Update Manager overview
3+
description: This article explains th roles and permission in Azure Update Manager.
4+
ms.service: azure-update-manager
5+
author: SnehaSudhirG
6+
ms.author: sudhirsneha
7+
ms.date: 07/19/2024
8+
ms.topic: overview
9+
---
10+
11+
# Roles and permissions
12+
13+
To manage an Azure VM or an Azure Arc-enabled server using Azure Update Manager, you must have the appropriate roles assigned. You can either use predefined roles or create custom roles with the specific permissions you need. For more information, see the [permissions](#permissions).
14+
15+
## Roles
16+
17+
The built-in roles provide blanket permissions on a virtual machine, which includes all Azure Update Manager permissions as well.
18+
19+
| **Resource** | **Role** |
20+
|---|---|
21+
| **Azure VM** | Azure Virtual Machine Contributor or Azure [Owner](../role-based-access-control/built-in-roles.md)|
22+
| **Azure Arc-enabled server** | [Azure Connected Machine Resource Administrator][Security overview for Azure Arc-enabled servers](../azure-arc/servers/security-overview.md)|
23+
24+
## Permissions
25+
26+
You need the following permissions to manage update operations. The following table shows the permissions that are needed when you use Update Manager. You can create a custom role and assign only the desired permissions to that role so that only permissions for specific actions are provided as per need.
27+
28+
### Read permissions for Update Manager to view Update Manager data
29+
30+
| **Actions** | **Permission** | **Scope** |
31+
|---|---|---|
32+
| **Read Azure VM properties** | Microsoft.Compute/virtualMachines/read | |
33+
| **Read assessment data for Azure VMs** | Microsoft.Compute/virtualMachines/patchAssessmentResults/read<br>Microsoft.Compute/virtualMachines/patchAssessmentResults/softwarePatches/read | |
34+
| **Read patch installation data for Azure VMs** | Microsoft.Compute/virtualMachines/patchInstallationResults/read<br>Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read | |
35+
| **Read Azure Arc-enabled server properties** | Microsoft.HybridCompute/machines/read | |
36+
| **Read assessment data for Azure Arc-enabled server** | Microsoft.HybridCompute/machines/patchAssessmentResults/read<br>Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read | |
37+
| **Read patch installation data for Azure Arc-enabled server** | Microsoft.HybridCompute/machines/patchInstallationResults/read<br>Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read | |
38+
| **Get the status of an asynchronous operation** **for Azure** **Virtual machine** | Microsoft.Compute/locations/operations/read | Machine subscription |
39+
| **Read the status of an update center operation on Arc machines** | Microsoft.HybridCompute/locations/updateCenterOperationResults/read | Machine subscription |
40+
41+
### Permissions to perform on-demand actions in Azure Update Manager
42+
43+
Note that following permissions would be required in addition to read permissions documented above on individual machines on which on-demand operations are performed.
44+
45+
| **Actions** | **Permission** | **Scope** |
46+
|---|---|---|
47+
| **Trigger** **assessment on Azure VMs** | Microsoft.Compute/virtualMachines/assessPatches/action | |
48+
| **Install update on Azure VMs** | Microsoft.Compute/virtualMachines/installPatches/action | |
49+
| **Get the status of an asynchronous operation for Azure Virtual machine** | Microsoft.Compute/locations/operations/read | Machine subscription |
50+
| **Trigger assessment on Azure Arc-enabled server** | Microsoft.HybridCompute/machines/assessPatches/action | |
51+
| **Install update on Azure Arc-enabled server** | Microsoft.HybridCompute/machines/installPatches/action | |
52+
| **Read the status of an update center operation on** **Arc** **machines** | Microsoft.HybridCompute/locations/updateCenterOperationResults/read | Machine subscription |
53+
| **Update patch** **mode /** **assessment mode** **for** **Azure Virtual** **Machines** | Microsoft.Compute/virtualMachines/write | Machine |
54+
| **Update assessment mode for** **Arc Machines** | Microsoft.HybridCompute/machines/write | Machine |
55+
56+
## Scheduled patching (Maintenance configuration) related permissions
57+
58+
Note that below permissions would be required in addition to permissions on individual machines, which are being managed by the schedules.
59+
60+
| **Actions** | **Permission** | **Scope** |
61+
|---|---|---|
62+
| **Register the subscription for the** **Microsoft.Maintenance resource provider** | Microsoft.Maintenance/register/action | Subscription |
63+
| **Create/modify maintenance configuration** | Microsoft.Maintenance/maintenanceConfigurations/write | Subscription/resource group |
64+
| **Create/modify configuration assignments** | Microsoft.Maintenance/configurationAssignments/write | Subscription/Resource group / machine |
65+
| **Read permission for Maintenance updates resource** | Microsoft.Maintenance/updates/read | Machine |
66+
| **Read permission for Maintenance apply updates resource** | Microsoft.Maintenance/applyUpdates/read | Machine |
67+
| **Get list** **of** **update deployment** | Microsoft.Resources/deployments/read | Maintenance configuration and virtual machine subscription |
68+
| **Create or update an** **update** ** deployment** | Microsoft.Resources/deployments/write | Maintenance configuration and virtual machine subscription |
69+
| **Get a list of** **update** **deployment operation statuses** | Microsoft.Resources/deployments/operationstatuses | Maintenance configuration and virtual machine subscription |
70+
71+
## Next steps
72+
- [Prerequisites of Update Manager](prerequisites.md).
73+
- [How Update Manager works](workflow-update-manager.md).

‎articles/update-manager/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ items:
1515
items:
1616
- name: Prerequisites
1717
href: prerequisites.md
18+
- name: Roles and Permissions
19+
href: roles-permissions.md
1820
- name: Support matrix
1921
href: support-matrix.md
2022
- name: Quickstarts

‎articles/virtual-machines/troubleshoot-maintenance-configurations.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ To create a dynamic scope, you must have the permission at the subscription leve
111111
1. The subscription/resource group at which the dynamic scope is being created.
112112
1. The maintenance configuration scope.
113113

114-
For more information, see the [list of permissions list for various resources here](../update-manager/overview.md#permissions).
114+
For more information, see the [list of permissions list for various resources here](../update-manager/roles-permissions.md#permissions).
115115

116116
### An update is stuck and not progressing
117117

0 commit comments

Comments
 (0)