Skip to content

Commit 9370c41

Browse files
committed
fix wording
1 parent f4e2fd1 commit 9370c41

File tree

2 files changed

+3
-5
lines changed

2 files changed

+3
-5
lines changed

articles/lighthouse/concepts/tenants-users-roles.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ All [built-in roles](../../role-based-access-control/built-in-roles.md) are curr
2525
- Any built-in roles with [DataActions](../../role-based-access-control/role-definitions.md#dataactions) permission are not supported.
2626
- The [User Access Administrator](../../role-based-access-control/built-in-roles.md#user-access-administrator) built-in role is supported, but only for the limited purpose of [assigning roles to a managed identity in the customer tenant](../how-to/deploy-policy-remediation.md#create-a-user-who-can-assign-roles-to-a-managed-identity-in-the-customer-tenant). No other permissions typically granted by this role will apply. If you define a user with this role, you must also specify the built-in role(s) that this user can assign to managed identities.
2727

28-
> [!NOTE]
29-
> Once an applicable new built-in role is added to Azure, it can be assigned when [onboarding a customer using Azure Resource Manager templates](../how-to/onboard-customer.md). There may be a short delay before the newly-added role is available to select in Cloud Partner Portal when [publishing a managed service offer](../how-to/publish-managed-services-offers.md).
28+
> [!NOTE]
29+
> Once an applicable new built-in role is added to Azure, it can be assigned when [onboarding a customer using Azure Resource Manager templates](../how-to/onboard-customer.md). There may be a delay before the newly-added role becomes available in Cloud Partner Portal when [publishing a managed service offer](../how-to/publish-managed-services-offers.md).
3030
3131
## Best practices for defining users and roles
3232

articles/lighthouse/how-to/publish-managed-services-offers.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,14 +82,12 @@ For each **Authorization**, you'll need to provide the following. You can then s
8282
- **Azure AD Object Display Name**: A friendly name to help the customer understand the purpose of this authorization. The customer will see this name when delegating resources.
8383
- **Role Definition**: Select one of the available Azure AD built-in roles from the list. This role will determine the permissions that the user in the **Azure AD Object ID** field will have on your customers' resources. For descriptions of these roles, see [Built-in roles](../../role-based-access-control/built-in-roles.md) and [Role support for Azure delegated resource management](../concepts/tenants-users-roles.md#role-support-for-azure-delegated-resource-management).
8484
> [!NOTE]
85-
> As applicable new built-in roles are added to Azure, they will become available here, although there may be some delay. If you don't see a newly-added role here, check back shortly.
85+
> As applicable new built-in roles are added to Azure, they will become available here, although there may be some delay before they appear.
8686
- **Assignable Roles**: This is required only if you have selected User Access Administrator in the **Role Definition** for this authorization. If so, you must add one or more assignable roles here. The user in the **Azure AD Object ID** field will be able to assign these **Assignable Roles** to [managed identities](../../active-directory/managed-identities-azure-resources/overview.md), which is required in order to [deploy policies that can be remediated](deploy-policy-remediation.md). Note that no other permissions normally associated with the User Access Administrator role will apply to this user. If you do not select one or more roles here, your submission will not pass certification. (If you did not select User Access Administrator for this user’s Role Definition, this field has no effect.)
8787

8888
> [!TIP]
8989
> To ensure you can [remove access to a delegation](onboard-customer.md#remove-access-to-a-delegation) if needed, include an **Authorization** with the **Role Definition** set to [Managed Services Registration Assignment Delete Role](../../role-based-access-control/built-in-roles.md#managed-services-registration-assignment-delete-role). If this role is not assigned, delegated resources can only be removed by a user in the customer's tenant.
9090
91-
92-
9391
Once you've completed the info, you can select **New plan** as many times as you need to create additional plans. When you're done, select **Save**, and then continue to the **Marketplace** section.
9492

9593
## Provide Marketplace text and images

0 commit comments

Comments
 (0)