Skip to content

Commit 93b6d0d

Browse files
PadmalathasPadmalathas
authored
New article defining RBAC roles
1 parent 39ff24d commit 93b6d0d

File tree

1 file changed

+338
-0
lines changed

1 file changed

+338
-0
lines changed

‎articles/batch/batch-role-based-access-control.md

Lines changed: 338 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,338 @@
1+
---
2+
title: Role-based access control for Azure Batch service
3+
description: Learn how to use Azure role-based access control for managing individual access to Azure Batch account.
4+
ms.topic: how-to
5+
ms.date: 12/11/2024
6+
---
7+
8+
# Role-based access control for Azure Batch service
9+
10+
Azure Batch Service supports a set of [built-in Azure roles](#azure-batch-built-in-rbac-roles) that provide different levels of permissions to Azure Batch account. By using Azure role-based access control ([Azure RBAC](/azure/role-based-access-control/)), an authorization system for managing individual access to Azure resources, you could assign specific permissions to users, service principals, or other identities that need to interact with your Batch account. You can also [assign custom roles](#assign-a-custom-role) with custom, fine-grained permissions that adapt your specific use scenario.
11+
12+
> [!NOTE]
13+
> All RBAC (both built-in and custom) roles are for users authenticated by Microsoft Entra ID, not for the Batch shared key credentials. The Batch shared key credentials give full permission to the Batch account.
14+
15+
## Assign Azure RBAC
16+
17+
Follow these steps to assign an Azure RBAC role to a user, group, service principal, or managed identity. For detailed steps, see [Assign Azure roles by using the Azure portal](/azure/role-based-access-control/role-assignments-portal).
18+
19+
1. In the Azure portal, navigate to your specific Batch account.
20+
> [!TIP]
21+
> You can also set up Azure RBAC for whole resource groups, subscriptions, or management groups. Do this by selecting the desired scope level and then navigating to the desired item. For example, selecting **Resource groups** and then navigating to a specific resource group.
22+
1. Select **Access control (IAM)** from the left navigation.
23+
1. On the **Access control (IAM)** page, select **Add role assignment**.
24+
1. On the **Add role assignment** page, select the **Role** tab, and then select one of [Azure Batch built-in RBAC roles](#azure-batch-built-in-rbac-roles).
25+
1. Select the **Members** tab, and select **Select members** under **Members**.
26+
1. On the **Select members** screen, search for and select a user, group, service principal, or managed identity, and then select **Select**.
27+
> [!NOTE]
28+
> When configuring an application to authenticate Azure Batch services with service principal, search and select your application here to configure its access and permissions to the Azure Batch account.
29+
1. Select **Review + assign** on the **Add role assignment** page.
30+
31+
The target identity should now appear on the **Role assignments** tab of the Batch account's **Access control (IAM)** page.
32+
33+
## Azure Batch built-in RBAC roles
34+
35+
Azure Batch has some predefined roles to address common user scenarios, ensuring appropriate access levels on Azure Batch account could be efficiently assigned to an identity for their specific duty.
36+
37+
> | Built-in role | Description | ID |
38+
> | --- | --- | --- |
39+
> | [Azure Batch Account Contributor](#azure-batch-account-contributor) | Grants full access to manage all Batch resources, including Batch accounts, pools, and jobs. | 29fe4964-1e60-436b-bd3a-77fd4c178b3c |
40+
> | [Azure Batch Account Reader](#azure-batch-account-reader) | Lets you view all resources including pools and jobs in the Batch account. | 11076f67-66f6-4be0-8f6b-f0609fd05cc9 |
41+
> | [Azure Batch Data Contributor](#azure-batch-data-contributor) | Grants permissions to manage Batch pools and jobs but not to modify accounts. | 6aaa78f1-f7de-44ca-8722-c64a23943cae |
42+
> | [Azure Batch Job Submitter](#azure-batch-job-submitter) | Lets you submit and manage jobs in the Batch account. | 48e5e92e-a480-4e71-aa9c-2778f4c13781 |
43+
44+
> | Permissions | Azure Batch Account Contributor | Azure Batch Account Reader | Azure Batch Data Contributor | Azure Batch Job Submitter |
45+
> | --- | --- | --- | --- | --- |
46+
> | List Batch accounts or view properties of a Batch account | ✓ | ✓ | ✓ | |
47+
> | Create, update or delete a Batch account | ✓ | | | |
48+
> | List access keys for a Batch account | ✓ | | | |
49+
> | Regenerate access keys for a Batch account | ✓ | | | |
50+
> | List or view properties of applications and application packages on a Batch account | ✓ | ✓ | ✓ | ✓ |
51+
> | Create, update or delete applications and application packages on a Batch account | ✓ | | ✓ | |
52+
> | List or view properties of certificates on a Batch account | ✓ | ✓ | ✓ | |
53+
> | Create, update or delete certificates on a Batch account | ✓ | | ✓ | |
54+
> | List or view properties of pools on a Batch account | ✓ | ✓ | ✓ | ✓ |
55+
> | Create, update or delete pools on a Batch account | ✓ | | ✓ | |
56+
> | List or view properties of jobs on a Batch account | ✓ | ✓ | ✓ | ✓ |
57+
> | Create, update or delete jobs on a Batch account | ✓ | | ✓ | ✓ |
58+
> | List or view properties of job schedules on a Batch account | ✓ | ✓ | ✓ | ✓ |
59+
> | Create, update or delete job schedules on a Batch account | ✓ | | ✓ | ✓ |
60+
61+
> [!WARNING]
62+
> The Batch account certificate feature has been [retired](./batch-certificate-migration-guide.md).
63+
64+
### Azure Batch Account Contributor
65+
66+
Grants full access to manage all Batch resources, including Batch accounts, pools, and jobs.
67+
68+
> | Actions | Description |
69+
> | --- | --- |
70+
> | [Microsoft.Authorization](/azure/role-based-access-control/permissions/management-and-governance#microsoftauthorization)/*/read | Read roles and role assignments. |
71+
> | [Microsoft.Insights](/azure/role-based-access-control/permissions/monitor#microsoftinsights)/alertRules/* | Create and manage a classic metric alert. |
72+
> | [Microsoft.Resources](/azure/role-based-access-control/permissions/management-and-governance#microsoftresources)/deployments/* | Create and manage a deployment. |
73+
> | [Microsoft.Resources](/azure/role-based-access-control/permissions/management-and-governance#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
74+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/* | |
75+
> | **NotActions** | |
76+
> | *none* | |
77+
> | **DataActions** | |
78+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/* | |
79+
> | **NotDataActions** | |
80+
> | *none* | |
81+
82+
```json
83+
{
84+
"assignableScopes": [
85+
"/"
86+
],
87+
"description": "Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.",
88+
"id": "/providers/Microsoft.Authorization/roleDefinitions/29fe4964-1e60-436b-bd3a-77fd4c178b3c",
89+
"permissions": [
90+
{
91+
"actions": [
92+
"Microsoft.Authorization/*/read",
93+
"Microsoft.Batch/batchAccounts/*",
94+
"Microsoft.Insights/alertRules/*",
95+
"Microsoft.Resources/deployments/*",
96+
"Microsoft.Resources/subscriptions/resourceGroups/read"
97+
],
98+
"dataActions": [
99+
"Microsoft.Batch/batchAccounts/*"
100+
],
101+
"notActions": [],
102+
"notDataActions": []
103+
}
104+
],
105+
"roleName": "Azure Batch Account Contributor",
106+
"roleType": "BuiltInRole",
107+
"type": "Microsoft.Authorization/roleDefinitions"
108+
}
109+
```
110+
111+
### Azure Batch Account Reader
112+
113+
Lets you view all resources including pools and jobs in the Batch account.
114+
115+
> | Actions | Description |
116+
> | --- | --- |
117+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/read | Lists Batch accounts or gets the properties of a Batch account. |
118+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/*/read | View all resources in Batch account. |
119+
> | [Microsoft.Resources](/azure/role-based-access-control/permissions/management-and-governance#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
120+
> | **NotActions** | |
121+
> | *none* | |
122+
> | **DataActions** | |
123+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/*/read | View all resources in Batch account. |
124+
> | **NotDataActions** | |
125+
> | *none* | |
126+
127+
```json
128+
{
129+
"assignableScopes": [
130+
"/"
131+
],
132+
"description": "Lets you view all resources including pools and jobs in the Batch account.",
133+
"id": "/providers/Microsoft.Authorization/roleDefinitions/11076f67-66f6-4be0-8f6b-f0609fd05cc9",
134+
"permissions": [
135+
{
136+
"actions": [
137+
"Microsoft.Batch/batchAccounts/read",
138+
"Microsoft.Batch/batchAccounts/*/read",
139+
"Microsoft.Resources/subscriptions/resourceGroups/read"
140+
],
141+
"dataActions": [
142+
"Microsoft.Batch/batchAccounts/*/read"
143+
],
144+
"notActions": [],
145+
"notDataActions": []
146+
}
147+
],
148+
"roleName": "Azure Batch Account Reader",
149+
"roleType": "BuiltInRole",
150+
"type": "Microsoft.Authorization/roleDefinitions"
151+
}
152+
```
153+
154+
### Azure Batch Data Contributor
155+
156+
Grants permissions to manage Batch pools and jobs but not to modify accounts.
157+
158+
> | Actions | Description |
159+
> | --- | --- |
160+
> | [Microsoft.Authorization](/azure/role-based-access-control/permissions/management-and-governance#microsoftauthorization)/*/read | Read roles and role assignments. |
161+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/read | Lists Batch accounts or gets the properties of a Batch account. |
162+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/applications/* | Create and manage applications and application packages on a Batch account. |
163+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/certificates/* | Create and manage certificates on a Batch account. |
164+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/certificateOperationResults/* | Gets the results of a long running certificate operation on a Batch account. |
165+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/pools/* | Create and manage pools on a Batch account. |
166+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/poolOperationResults/* | Gets the results of a long running pool operation on a Batch account. |
167+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/locations/*/read | Get Batch account operation result/Batch quota/supported VM size at the given location. |
168+
> | [Microsoft.Insights](/azure/role-based-access-control/permissions/monitor#microsoftinsights)/alertRules/* | Create and manage a classic metric alert. |
169+
> | [Microsoft.Resources](/azure/role-based-access-control/permissions/management-and-governance#microsoftresources)/deployments/* | Create and manage a deployment. |
170+
> | [Microsoft.Resources](/azure/role-based-access-control/permissions/management-and-governance#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
171+
> | **NotActions** | |
172+
> | *none* | |
173+
> | **DataActions** | |
174+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/jobSchedules/* | Create and manage job schedules on a Batch account. |
175+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/jobs/* | Create and manage jobs on a Batch account. |
176+
> | **NotDataActions** | |
177+
> | *none* | |
178+
179+
```json
180+
{
181+
"assignableScopes": [
182+
"/"
183+
],
184+
"description": "Grants permissions to manage Batch pools and jobs but not to modify accounts.",
185+
"id": "/providers/Microsoft.Authorization/roleDefinitions/6aaa78f1-f7de-44ca-8722-c64a23943cae",
186+
"permissions": [
187+
{
188+
"actions": [
189+
"Microsoft.Authorization/*/read",
190+
"Microsoft.Batch/batchAccounts/read",
191+
"Microsoft.Batch/batchAccounts/applications/*",
192+
"Microsoft.Batch/batchAccounts/certificates/*",
193+
"Microsoft.Batch/batchAccounts/certificateOperationResults/*",
194+
"Microsoft.Batch/batchAccounts/pools/*",
195+
"Microsoft.Batch/batchAccounts/poolOperationResults/*",
196+
"Microsoft.Batch/locations/*/read",
197+
"Microsoft.Insights/alertRules/*",
198+
"Microsoft.Resources/deployments/*",
199+
"Microsoft.Resources/subscriptions/resourceGroups/read"
200+
],
201+
"dataActions": [
202+
"Microsoft.Batch/batchAccounts/jobSchedules/*",
203+
"Microsoft.Batch/batchAccounts/jobs/*"
204+
],
205+
"notActions": [],
206+
"notDataActions": []
207+
}
208+
],
209+
"roleName": "Azure Batch Data Contributor",
210+
"roleType": "BuiltInRole",
211+
"type": "Microsoft.Authorization/roleDefinitions"
212+
}
213+
```
214+
215+
### Azure Batch Job Submitter
216+
217+
Lets you submit and manage jobs in the Batch account.
218+
219+
> | Actions | Description |
220+
> | --- | --- |
221+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/applications/read | Lists applications or gets the properties of an application. |
222+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/applications/versions/read | Gets the properties of an application package. |
223+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/pools/read | Lists pools on a Batch account or gets the properties of a pool. |
224+
> | [Microsoft.Insights](/azure/role-based-access-control/permissions/monitor#microsoftinsights)/alertRules/* | Create and manage a classic metric alert. |
225+
> | [Microsoft.Resources](/azure/role-based-access-control/permissions/management-and-governance#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
226+
> | **NotActions** | |
227+
> | *none* | |
228+
> | **DataActions** | |
229+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/jobSchedules/* | Create and manage job schedules on a Batch account. |
230+
> | [Microsoft.Batch](/azure/role-based-access-control/permissions/compute#microsoftbatch)/batchAccounts/jobs/* | Create and manage jobs on a Batch account. |
231+
> | **NotDataActions** | |
232+
> | *none* | |
233+
234+
```json
235+
{
236+
"assignableScopes": [
237+
"/"
238+
],
239+
"description": "Lets you submit and manage jobs in the Batch account.",
240+
"id": "/providers/Microsoft.Authorization/roleDefinitions/48e5e92e-a480-4e71-aa9c-2778f4c13781",
241+
"permissions": [
242+
{
243+
"actions": [
244+
"Microsoft.Batch/batchAccounts/applications/read",
245+
"Microsoft.Batch/batchAccounts/applications/versions/read",
246+
"Microsoft.Batch/batchAccounts/pools/read",
247+
"Microsoft.Insights/alertRules/*",
248+
"Microsoft.Resources/subscriptions/resourceGroups/read"
249+
],
250+
"dataActions": [
251+
"Microsoft.Batch/batchAccounts/jobSchedules/*",
252+
"Microsoft.Batch/batchAccounts/jobs/*"
253+
],
254+
"notActions": [],
255+
"notDataActions": []
256+
}
257+
],
258+
"roleName": "Azure Batch Job Submitter",
259+
"roleType": "BuiltInRole",
260+
"type": "Microsoft.Authorization/roleDefinitions"
261+
}
262+
```
263+
264+
## Assign a custom role
265+
266+
If Azure Batch built-in roles don't meet your needs, [Azure custom roles](../role-based-access-control/custom-roles.md) could be used to grant granular permission to a user for submitting jobs, tasks, and more. You can use a custom role to grant or deny permissions to a Microsoft Entra ID for the following Azure Batch RBAC operations.
267+
268+
- Microsoft.Batch/batchAccounts/pools/write
269+
- Microsoft.Batch/batchAccounts/pools/delete
270+
- Microsoft.Batch/batchAccounts/pools/read
271+
- Microsoft.Batch/batchAccounts/jobSchedules/write
272+
- Microsoft.Batch/batchAccounts/jobSchedules/delete
273+
- Microsoft.Batch/batchAccounts/jobSchedules/read
274+
- Microsoft.Batch/batchAccounts/jobs/write
275+
- Microsoft.Batch/batchAccounts/jobs/delete
276+
- Microsoft.Batch/batchAccounts/jobs/read
277+
- Microsoft.Batch/batchAccounts/certificates/write
278+
- Microsoft.Batch/batchAccounts/certificates/delete
279+
- Microsoft.Batch/batchAccounts/certificates/read
280+
- Microsoft.Batch/batchAccounts/applications/write
281+
- Microsoft.Batch/batchAccounts/applications/delete
282+
- Microsoft.Batch/batchAccounts/applications/read
283+
- Microsoft.Batch/batchAccounts/applications/versions/write
284+
- Microsoft.Batch/batchAccounts/applications/versions/delete
285+
- Microsoft.Batch/batchAccounts/applications/versions/read
286+
- Microsoft.Batch/batchAccounts/read, for any read operation
287+
- Microsoft.Batch/batchAccounts/listKeys/action, for any operation
288+
289+
> [!TIP]
290+
> Jobs that use [autopool](nodes-and-pools.md#autopools) require pool-level write permissions.
291+
292+
> [!NOTE]
293+
> Certain role assignments need to be specified in the `actions` field, whereas others need to be specified in the `dataActions` field. You need to examine both `actions` and `dataActions` to understand the full scope of capabilities assigned to a role. For more information, see [Azure resource provider operations](/azure/role-based-access-control/permissions/compute#microsoftbatch).
294+
295+
296+
The following example shows an Azure Batch custom role definition:
297+
298+
```json
299+
{
300+
"properties":{
301+
"roleName":"Azure Batch Custom Job Submitter",
302+
"type":"CustomRole",
303+
"description":"Allows a user to submit autopool jobs to Azure Batch",
304+
"assignableScopes":[
305+
"/subscriptions/88888888-8888-8888-8888-888888888888"
306+
],
307+
"permissions":[
308+
{
309+
"actions":[
310+
"Microsoft.Batch/*/read",
311+
"Microsoft.Batch/batchAccounts/pools/write",
312+
"Microsoft.Batch/batchAccounts/pools/delete",
313+
"Microsoft.Authorization/*/read",
314+
"Microsoft.Resources/subscriptions/resourceGroups/read",
315+
"Microsoft.Support/*",
316+
"Microsoft.Insights/alertRules/*"
317+
],
318+
"notActions":[
319+
320+
],
321+
"dataActions":[
322+
"Microsoft.Batch/batchAccounts/jobs/*",
323+
"Microsoft.Batch/batchAccounts/jobSchedules/*"
324+
],
325+
"notDataActions":[
326+
327+
]
328+
}
329+
]
330+
}
331+
}
332+
```
333+
334+
## Next steps
335+
336+
- [Create a Batch account in the Azure portal](./batch-account-create-portal.md)
337+
- [Authenticate Batch Management solutions with Microsoft Entra ID](./batch-aad-auth-management.md)
338+
- [Authenticate Azure Batch services with Microsoft Entra ID](./batch-aad-auth.md)

0 commit comments

Comments
 (0)