Skip to content

Commit 9773be9

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #212391 from rolyon/rolyon-rbac-roles-windows-admin-center-admin-login
[Azure RBAC] Windows Admin Center Administrator Login
2 parents 32de719 + c76c0b4 commit 9773be9

File tree

2 files changed

+258
-18
lines changed

2 files changed

+258
-18
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 126 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.workload: identity
88
author: rolyon
99
manager: amycolannino
1010
ms.author: rolyon
11-
ms.date: 09/09/2022
11+
ms.date: 09/23/2022
1212
ms.custom: generated
1313
---
1414

@@ -40,6 +40,7 @@ The following table provides a brief description of each built-in role. Click th
4040
> | [Virtual Machine Administrator Login](#virtual-machine-administrator-login) | View Virtual Machines in the portal and login as administrator | 1c0163c0-47e6-4577-8991-ea5c82e286e4 |
4141
> | [Virtual Machine Contributor](#virtual-machine-contributor) | Create and manage virtual machines, manage disks, install and run software, reset password of the root user of the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role does not grant you management access to the virtual network or storage account the virtual machines are connected to. This role does not allow you to assign roles in Azure RBAC. | 9980e02c-c2be-4d73-94e8-173b1dc7cf3c |
4242
> | [Virtual Machine User Login](#virtual-machine-user-login) | View Virtual Machines in the portal and login as a regular user. | fb879df8-f326-4884-b1cf-06f3ad86be52 |
43+
> | [Windows Admin Center Administrator Login](#windows-admin-center-administrator-login) | Let's you manage the OS of your resource via Windows Admin Center as an administrator. | a6333a3e-0164-44c3-b281-7a577aff287f |
4344
> | **Networking** | | |
4445
> | [CDN Endpoint Contributor](#cdn-endpoint-contributor) | Can manage CDN endpoints, but can't grant access to other users. | 426e0c7f-0c7e-4658-b36f-ff54d6c29b45 |
4546
> | [CDN Endpoint Reader](#cdn-endpoint-reader) | Can view CDN endpoints, but can't make changes. | 871e35f6-b5c1-49cc-a043-bde969a0f2cd |
@@ -1022,6 +1023,121 @@ View Virtual Machines in the portal and login as a regular user. [Learn more](..
10221023
}
10231024
```
10241025

1026+
### Windows Admin Center Administrator Login
1027+
1028+
Let's you manage the OS of your resource via Windows Admin Center as an administrator. [Learn more](/windows-server/manage/windows-admin-center/azure/manage-vm)
1029+
1030+
> [!div class="mx-tableFixed"]
1031+
> | Actions | Description |
1032+
> | --- | --- |
1033+
> | [Microsoft.HybridCompute](resource-provider-operations.md#microsofthybridcompute)/machines/*/read | |
1034+
> | [Microsoft.HybridCompute](resource-provider-operations.md#microsofthybridcompute)/machines/extensions/* | |
1035+
> | [Microsoft.HybridCompute](resource-provider-operations.md#microsofthybridcompute)/machines/upgradeExtensions/action | Upgrades Extensions on Azure Arc machines |
1036+
> | [Microsoft.HybridCompute](resource-provider-operations.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |
1037+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |
1038+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/loadBalancers/read | Gets a load balancer definition |
1039+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/publicIPAddresses/read | Gets a public ip address definition. |
1040+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
1041+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/networkSecurityGroups/read | Gets a network security group definition |
1042+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/networkSecurityGroups/defaultSecurityRules/read | Gets a default security rule definition |
1043+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/networkWatchers/securityGroupView/action | View the configured and effective network security group rules applied on a VM. |
1044+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/networkSecurityGroups/securityRules/read | Gets a security rule definition |
1045+
> | [Microsoft.Network](resource-provider-operations.md#microsoftnetwork)/networkSecurityGroups/securityRules/write | Creates a security rule or updates an existing security rule |
1046+
> | [Microsoft.HybridConnectivity](resource-provider-operations.md#microsofthybridconnectivity)/endpoints/write | Create or update the endpoint to the target resource. |
1047+
> | [Microsoft.HybridConnectivity](resource-provider-operations.md#microsofthybridconnectivity)/endpoints/read | Get or list of endpoints to the target resource. |
1048+
> | [Microsoft.HybridConnectivity](resource-provider-operations.md#microsofthybridconnectivity)/endpoints/listManagedProxyDetails/action | |
1049+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |
1050+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/patchAssessmentResults/latest/read | Retrieves the summary of the latest patch assessment operation |
1051+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/patchAssessmentResults/latest/softwarePatches/read | Retrieves list of patches assessed during the last patch assessment operation |
1052+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/patchInstallationResults/read | Retrieves the summary of the latest patch installation operation |
1053+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/patchInstallationResults/softwarePatches/read | Retrieves list of patches attempted to be installed during the last patch installation operation |
1054+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/extensions/read | Get the properties of a virtual machine extension |
1055+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/instanceView/read | Gets the detailed runtime status of the virtual machine and its resources |
1056+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/runCommands/read | Get the properties of a virtual machine run command |
1057+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/vmSizes/read | Lists available sizes the virtual machine can be updated to |
1058+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/locations/publishers/artifacttypes/types/read | Get the properties of a VMExtension Type |
1059+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/locations/publishers/artifacttypes/types/versions/read | Get the properties of a VMExtension Version |
1060+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/diskAccesses/read | Get the properties of DiskAccess resource |
1061+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/galleries/images/read | Gets the properties of Gallery Image |
1062+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/images/read | Get the properties of the Image |
1063+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Clusters/Read | Gets clusters |
1064+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Clusters/ArcSettings/Read | Gets arc resource of HCI cluster |
1065+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Clusters/ArcSettings/Extensions/Read | Gets extension resource of HCI cluster |
1066+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Clusters/ArcSettings/Extensions/Write | Create or update extension resource of HCI cluster |
1067+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Clusters/ArcSettings/Extensions/Delete | Delete extension resources of HCI cluster |
1068+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Operations/Read | Gets operations |
1069+
> | **NotActions** | |
1070+
> | *none* | |
1071+
> | **DataActions** | |
1072+
> | [Microsoft.HybridCompute](resource-provider-operations.md#microsofthybridcompute)/machines/WACLoginAsAdmin/action | Lets you manage the OS of your resource via Windows Admin Center as an administrator. |
1073+
> | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/virtualMachines/WACloginAsAdmin/action | Lets you manage the OS of your resource via Windows Admin Center as an administrator |
1074+
> | [Microsoft.AzureStackHCI](resource-provider-operations.md#microsoftazurestackhci)/Clusters/WACloginAsAdmin/Action | Manage OS of HCI resource via Windows Admin Center as an administrator |
1075+
> | **NotDataActions** | |
1076+
> | *none* | |
1077+
1078+
```json
1079+
{
1080+
"assignableScopes": [
1081+
"/"
1082+
],
1083+
"description": "Let's you manage the OS of your resource via Windows Admin Center as an administrator.",
1084+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/a6333a3e-0164-44c3-b281-7a577aff287f",
1085+
"name": "a6333a3e-0164-44c3-b281-7a577aff287f",
1086+
"permissions": [
1087+
{
1088+
"actions": [
1089+
"Microsoft.HybridCompute/machines/*/read",
1090+
"Microsoft.HybridCompute/machines/extensions/*",
1091+
"Microsoft.HybridCompute/machines/upgradeExtensions/action",
1092+
"Microsoft.HybridCompute/operations/read",
1093+
"Microsoft.Network/networkInterfaces/read",
1094+
"Microsoft.Network/loadBalancers/read",
1095+
"Microsoft.Network/publicIPAddresses/read",
1096+
"Microsoft.Network/virtualNetworks/read",
1097+
"Microsoft.Network/networkSecurityGroups/read",
1098+
"Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
1099+
"Microsoft.Network/networkWatchers/securityGroupView/action",
1100+
"Microsoft.Network/networkSecurityGroups/securityRules/read",
1101+
"Microsoft.Network/networkSecurityGroups/securityRules/write",
1102+
"Microsoft.HybridConnectivity/endpoints/write",
1103+
"Microsoft.HybridConnectivity/endpoints/read",
1104+
"Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action",
1105+
"Microsoft.Compute/virtualMachines/read",
1106+
"Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read",
1107+
"Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read",
1108+
"Microsoft.Compute/virtualMachines/patchInstallationResults/read",
1109+
"Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read",
1110+
"Microsoft.Compute/virtualMachines/extensions/read",
1111+
"Microsoft.Compute/virtualMachines/instanceView/read",
1112+
"Microsoft.Compute/virtualMachines/runCommands/read",
1113+
"Microsoft.Compute/virtualMachines/vmSizes/read",
1114+
"Microsoft.Compute/locations/publishers/artifacttypes/types/read",
1115+
"Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read",
1116+
"Microsoft.Compute/diskAccesses/read",
1117+
"Microsoft.Compute/galleries/images/read",
1118+
"Microsoft.Compute/images/read",
1119+
"Microsoft.AzureStackHCI/Clusters/Read",
1120+
"Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
1121+
"Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read",
1122+
"Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write",
1123+
"Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete",
1124+
"Microsoft.AzureStackHCI/Operations/Read"
1125+
],
1126+
"notActions": [],
1127+
"dataActions": [
1128+
"Microsoft.HybridCompute/machines/WACLoginAsAdmin/action",
1129+
"Microsoft.Compute/virtualMachines/WACloginAsAdmin/action",
1130+
"Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action"
1131+
],
1132+
"notDataActions": []
1133+
}
1134+
],
1135+
"roleName": "Windows Admin Center Administrator Login",
1136+
"roleType": "BuiltInRole",
1137+
"type": "Microsoft.Authorization/roleDefinitions"
1138+
}
1139+
```
1140+
10251141
## Networking
10261142

10271143

@@ -4198,6 +4314,7 @@ Full access to Azure SignalR Service REST APIs
41984314
> | [Microsoft.SignalRService](resource-provider-operations.md#microsoftsignalrservice)/SignalR/user/send/action | Send messages to user, who may consist of multiple client connections. |
41994315
> | [Microsoft.SignalRService](resource-provider-operations.md#microsoftsignalrservice)/SignalR/user/read | Check user existence. |
42004316
> | [Microsoft.SignalRService](resource-provider-operations.md#microsoftsignalrservice)/SignalR/user/write | Modify a user. |
4317+
> | [Microsoft.SignalRService](resource-provider-operations.md#microsoftsignalrservice)/SignalR/livetrace/* | |
42014318
> | **NotDataActions** | |
42024319
> | *none* | |
42034320

@@ -4226,7 +4343,8 @@ Full access to Azure SignalR Service REST APIs
42264343
"Microsoft.SignalRService/SignalR/serverConnection/write",
42274344
"Microsoft.SignalRService/SignalR/user/send/action",
42284345
"Microsoft.SignalRService/SignalR/user/read",
4229-
"Microsoft.SignalRService/SignalR/user/write"
4346+
"Microsoft.SignalRService/SignalR/user/write",
4347+
"Microsoft.SignalRService/SignalR/livetrace/*"
42304348
],
42314349
"notDataActions": []
42324350
}
@@ -12706,6 +12824,7 @@ Management Group Contributor Role [Learn more](../governance/management-groups/o
1270612824
> | [Microsoft.Management](resource-provider-operations.md#microsoftmanagement)/managementGroups/subscriptions/write | Associates existing subscription with the management group. |
1270712825
> | [Microsoft.Management](resource-provider-operations.md#microsoftmanagement)/managementGroups/write | Create or update a management group. |
1270812826
> | [Microsoft.Management](resource-provider-operations.md#microsoftmanagement)/managementGroups/subscriptions/read | Lists subscription under the given management group. |
12827+
> | [Microsoft.Authorization](resource-provider-operations.md#microsoftauthorization)/*/read | Read roles and role assignments |
1270912828
> | **NotActions** | |
1271012829
> | *none* | |
1271112830
> | **DataActions** | |
@@ -12729,7 +12848,8 @@ Management Group Contributor Role [Learn more](../governance/management-groups/o
1272912848
"Microsoft.Management/managementGroups/subscriptions/delete",
1273012849
"Microsoft.Management/managementGroups/subscriptions/write",
1273112850
"Microsoft.Management/managementGroups/write",
12732-
"Microsoft.Management/managementGroups/subscriptions/read"
12851+
"Microsoft.Management/managementGroups/subscriptions/read",
12852+
"Microsoft.Authorization/*/read"
1273312853
],
1273412854
"notActions": [],
1273512855
"dataActions": [],
@@ -12751,6 +12871,7 @@ Management Group Reader Role
1275112871
> | --- | --- |
1275212872
> | [Microsoft.Management](resource-provider-operations.md#microsoftmanagement)/managementGroups/read | List management groups for the authenticated user. |
1275312873
> | [Microsoft.Management](resource-provider-operations.md#microsoftmanagement)/managementGroups/subscriptions/read | Lists subscription under the given management group. |
12874+
> | [Microsoft.Authorization](resource-provider-operations.md#microsoftauthorization)/*/read | Read roles and role assignments |
1275412875
> | **NotActions** | |
1275512876
> | *none* | |
1275612877
> | **DataActions** | |
@@ -12770,7 +12891,8 @@ Management Group Reader Role
1277012891
{
1277112892
"actions": [
1277212893
"Microsoft.Management/managementGroups/read",
12773-
"Microsoft.Management/managementGroups/subscriptions/read"
12894+
"Microsoft.Management/managementGroups/subscriptions/read",
12895+
"Microsoft.Authorization/*/read"
1277412896
],
1277512897
"notActions": [],
1277612898
"dataActions": [],

0 commit comments

Comments
 (0)