Skip to content

Commit 8b6536f

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #289353 from rolyon/rolyon-rbac-roles-azure-managed-grafana-workspace-contributor
[Azure RBAC] Azure Managed Grafana Workspace Contributor
2 parents 6e33ef2 + 9b0b623 commit 8b6536f

File tree

2 files changed

+98
-0
lines changed

2 files changed

+98
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -465,6 +465,7 @@ The following table provides a brief description of each built-in role. Click th
465465
> | --- | --- | --- |
466466
> | <a name='application-insights-component-contributor'></a>[Application Insights Component Contributor](./built-in-roles/monitor.md#application-insights-component-contributor) | Can manage Application Insights components | ae349356-3a1b-4a5e-921d-050484c6347e |
467467
> | <a name='application-insights-snapshot-debugger'></a>[Application Insights Snapshot Debugger](./built-in-roles/monitor.md#application-insights-snapshot-debugger) | Gives user permission to view and download debug snapshots collected with the Application Insights Snapshot Debugger. Note that these permissions are not included in the [Owner](/azure/role-based-access-control/built-in-roles#owner) or [Contributor](/azure/role-based-access-control/built-in-roles#contributor) roles. When giving users the Application Insights Snapshot Debugger role, you must grant the role directly to the user. The role is not recognized when it is added to a custom role. | 08954f03-6346-4c2e-81c0-ec3a5cfae23b |
468+
> | <a name='azure-managed-grafana-workspace-contributor'></a>[Azure Managed Grafana Workspace Contributor](./built-in-roles/monitor.md#azure-managed-grafana-workspace-contributor) | Can manage Azure Managed Grafana resources, without providing access to the workspaces themselves. | 5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95 |
468469
> | <a name='grafana-admin'></a>[Grafana Admin](./built-in-roles/monitor.md#grafana-admin) | Manage server-wide settings and manage access to resources such as organizations, users, and licenses. | 22926164-76b3-42b3-bc55-97df8dab3e41 |
469470
> | <a name='grafana-editor'></a>[Grafana Editor](./built-in-roles/monitor.md#grafana-editor) | Create, edit, delete, or view dashboards; create, edit, or delete folders; and edit or view playlists. | a79a5197-3a5c-4973-a920-486035ffd60f |
470471
> | <a name='grafana-limited-viewer'></a>[Grafana Limited Viewer](./built-in-roles/monitor.md#grafana-limited-viewer) | View home page. | 41e04612-9dac-4699-a02b-c82ff2cc3fb5 |

‎articles/role-based-access-control/built-in-roles/monitor.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,103 @@ Gives user permission to view and download debug snapshots collected with the Ap
132132
}
133133
```
134134

135+
## Azure Managed Grafana Workspace Contributor
136+
137+
Can manage Azure Managed Grafana resources, without providing access to the workspaces themselves.
138+
139+
> [!div class="mx-tableFixed"]
140+
> | Actions | Description |
141+
> | --- | --- |
142+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/write | Write grafana |
143+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/delete | Delete grafana |
144+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/PrivateEndpointConnectionsApproval/action | Approve PrivateEndpointConnection |
145+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/managedPrivateEndpoints/action | Operations on Private Endpoints |
146+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/locations/operationStatuses/write | Write operation statuses |
147+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/privateEndpointConnectionProxies/validate/action | Validate PrivateEndpointConnectionProxy |
148+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/privateEndpointConnectionProxies/write | Create/Update PrivateEndpointConnectionProxy |
149+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/privateEndpointConnectionProxies/delete | Delete PrivateEndpointConnectionProxy |
150+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/privateEndpointConnections/write | Update PrivateEndpointConnection |
151+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/privateEndpointConnections/delete | Delete PrivateEndpointConnection |
152+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/managedPrivateEndpoints/write | Write Managed Private Endpoints |
153+
> | [Microsoft.Dashboard](../permissions/monitor.md#microsoftdashboard)/grafana/managedPrivateEndpoints/delete | Delete Managed Private Endpoints |
154+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
155+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
156+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
157+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
158+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
159+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
160+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
161+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
162+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
163+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
164+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
165+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
166+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates an deployment. |
167+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
168+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
169+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
170+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
171+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
172+
> | **NotActions** | |
173+
> | *none* | |
174+
> | **DataActions** | |
175+
> | *none* | |
176+
> | **NotDataActions** | |
177+
> | *none* | |
178+
179+
```json
180+
{
181+
"assignableScopes": [
182+
"/"
183+
],
184+
"description": "Can manage Azure Managed Grafana resources, without providing access to the workspaces themselves.",
185+
"id": "/providers/Microsoft.Authorization/roleDefinitions/5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95",
186+
"name": "5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95",
187+
"permissions": [
188+
{
189+
"actions": [
190+
"Microsoft.Dashboard/grafana/write",
191+
"Microsoft.Dashboard/grafana/delete",
192+
"Microsoft.Dashboard/grafana/PrivateEndpointConnectionsApproval/action",
193+
"Microsoft.Dashboard/grafana/managedPrivateEndpoints/action",
194+
"Microsoft.Dashboard/locations/operationStatuses/write",
195+
"Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/validate/action",
196+
"Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/write",
197+
"Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/delete",
198+
"Microsoft.Dashboard/grafana/privateEndpointConnections/write",
199+
"Microsoft.Dashboard/grafana/privateEndpointConnections/delete",
200+
"Microsoft.Dashboard/grafana/managedPrivateEndpoints/write",
201+
"Microsoft.Dashboard/grafana/managedPrivateEndpoints/delete",
202+
"Microsoft.Authorization/*/read",
203+
"Microsoft.Insights/AlertRules/Write",
204+
"Microsoft.Insights/AlertRules/Delete",
205+
"Microsoft.Insights/AlertRules/Read",
206+
"Microsoft.Insights/AlertRules/Activated/Action",
207+
"Microsoft.Insights/AlertRules/Resolved/Action",
208+
"Microsoft.Insights/AlertRules/Throttled/Action",
209+
"Microsoft.Insights/AlertRules/Incidents/Read",
210+
"Microsoft.Resources/deployments/read",
211+
"Microsoft.Resources/deployments/write",
212+
"Microsoft.Resources/deployments/delete",
213+
"Microsoft.Resources/deployments/cancel/action",
214+
"Microsoft.Resources/deployments/validate/action",
215+
"Microsoft.Resources/deployments/whatIf/action",
216+
"Microsoft.Resources/deployments/exportTemplate/action",
217+
"Microsoft.Resources/deployments/operations/read",
218+
"Microsoft.Resources/deployments/operationstatuses/read",
219+
"Microsoft.Resources/subscriptions/resourceGroups/read"
220+
],
221+
"notActions": [],
222+
"dataActions": [],
223+
"notDataActions": []
224+
}
225+
],
226+
"roleName": "Azure Managed Grafana Workspace Contributor",
227+
"roleType": "BuiltInRole",
228+
"type": "Microsoft.Authorization/roleDefinitions"
229+
}
230+
```
231+
135232
## Grafana Admin
136233

137234
Manage server-wide settings and manage access to resources such as organizations, users, and licenses.

0 commit comments

Comments
 (0)