Merge pull request #209846 from Juliako/restrictedrole

Restrictedrole

Author: v-dirichards

articles/azure-video-indexer/connect-classic-account-to-arm.md

@@ -9,13 +9,11 @@ ms.custom: ignite-fall-2021
 
 # Connect an existing classic paid Azure Video Indexer account to ARM-based account  
 
-This article details how to connect an existing classic paid Azure Video Indexer account to an Azure Resource Manager (ARM) based account.
-Today, Azure Video Indexer, is a GA(general availability) product that is not an ARM resource on Azure.
-In this article, we will go through options on connecting your **existing** Azure Video Indexer account to [ARM][docs-arm-overview].
+This article shows how to connect an existing classic paid Azure Video Indexer account to an Azure Resource Manager (ARM)-based (recommended) account. To create a new ARM-based account, see [create a new account](create-account-portal.md). To understand the Azure Video Indexer account types, review [account types](accounts-overview.md).
 
-## Prerequisites
+In this article, we demonstrate options of connecting your **existing** Azure Video Indexer account to an [ARM][docs-arm-overview]-based account.
 
-Before creating a new account, review [Account types](accounts-overview.md).
+## Prerequisites
 
 1. Unlimited paid Azure Video Indexer account (classic account).
 

articles/azure-video-indexer/media/restricted-viewer-role/no-access.png

@@ -0,0 +1,53 @@
+---
+title: Video Indexer restricted viewer built-in role
+description: This article talks about Video Indexer restricted viewer built-in role. This role is an account level permission, which allows users to grant restricted access to a specific user or security group. 
+ms.topic: how-to
+ms.date: 09/12/2022
+---
+
+# Manage access with the Video Indexer Restricted Viewer role
+
+Azure Video Indexer enables managing user access to the Azure Video Indexer resource at the account level with the following built-in role: **Video Indexer Restricted Viewer**. 
+
+> [!NOTE]
+> The **Video Indexer Restricted Viewer** built-in role is only available for ARM-based (recommended) accounts, not classic accounts. If you have an existing classic account, see [Connect an existing classic paid account to an ARM-based account](connect-classic-account-to-arm.md).
+
+Users with the owner or administrator Azure Active Directory (Azure AD) permissions can assign the **Video Indexer Restricted Viewer** role to  Azure AD users or security groups for an account. For information on how to assign roles, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md). 
+
+The limited access Video Indexer Restricted Viewer role is intended for the [Azure Video Indexer website](https://www.videoindexer.ai/) users as its permitted actions relate to the [Azure Video Indexer website](https://www.videoindexer.ai/) experience.
+
+## Azure Video Indexer Restricted Viewer permissions
+
+Users with this role are **able** to perform the following tasks:
+
+- View and play videos in the account
+- Search through insights in the account
+- Translate the transcription of a specific video
+
+Users with this role are **unable** to perform the following tasks:
+
+- Upload/Index/Re-index a video
+- Download/Embed video/insights 
+- Change account settings 
+- Edit insights 
+- Create/update customized models 
+  - Language  
+  - People  
+  - Brands 
+- Assign roles
+- Generate an access token 
+
+## Using an ARM API
+
+To generate a Video Indexer restricted viewer access token via API, see [documentation](https://aka.ms/vi-restricted-doc). 
+
+## Restricted Viewer Video Indexer website experience
+ 
+When using the [Azure Video Indexer](https://www.videoindexer.ai/) website with a Video Indexer Restricted Viewer access, disabled features are greyed out. If a user with the restricted viewer role attempts to access an unauthorized page, they'll encounter the pop-up message below: 
+
+> [!div class="mx-imgBorder"]
+> :::image type="content" source="./media/restricted-viewer-role/no-access.png" alt-text="No access to the gallery page.":::
+
+## Next steps
+
+[Overview](video-indexer-overview.md)

articles/azure-video-indexer/restricted-viewer-role.md

@@ -90,14 +90,16 @@
   items:
   - name: Manage accounts
     items:
-    - name: Create a classic account
-      href: connect-to-azure.md
+    - name: Manage access to your account
+      href: restricted-viewer-role.md
     - name: Connect an existing account to ARM
       href: connect-classic-account-to-arm.md
     - name: Add contributor role to Media Services
       href: add-contributor-role-on-the-media-service.md    
     - name: Import content from the trial account
       href: import-content-from-trial.md
+    - name: Create a classic account
+      href: connect-to-azure.md
   - name: Upload and index media
     items:
     - name: Upload and index videos