Skip to content

Commit 99afb5f

Browse files
author
AbhishekMallick-MS
committed
Restore VM updates
1 parent 963ca4f commit 99afb5f

File tree

2 files changed

+169
-20
lines changed

2 files changed

+169
-20
lines changed

‎articles/backup/backup-azure-arm-restore-vms.md

Lines changed: 55 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -330,34 +330,69 @@ For more information, see [Back up and restore Active Directory domain controlle
330330

331331
Managed identities eliminate the need for the user to maintain the credentials. Managed identities provide an identity for applications to use when connecting to resources that support Microsoft Entra authentication.
332332

333-
Azure Backup offers the flexibility to restore the managed Azure VM with [managed identities](../active-directory/managed-identities-azure-resources/overview.md). You can choose to select [system-managed identities](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the [**Restore configuration** blade](#create-a-vm) of Azure VM. Managed identities used as one of the input parameters is only used for accessing the storage accounts, which are used as staging location during restore and not for any other Azure resource controlling. These managed identities have to be associated to the vault.
333+
Azure Backup offers the flexibility to restore the managed Azure VM with [managed identities](../active-directory/managed-identities-azure-resources/overview.md). You can choose to select [system-managed identities](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the [**Restore configuration** blade](#create-a-vm) of Azure VM. Managed identities are used for accessing the storage accounts and automated cleanup of any resources created during restore process in case of restore failures. These managed identities have to be associated to the vault.
334334

335335
:::image type="content" source="./media/backup-azure-arm-restore-vms/select-system-managed-identities-or-user-managed-identities.png" alt-text="Screenshot for choice to select system-managed identities or user-managed identities.":::
336336

337-
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account.
337+
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account and Resource Group.
338338

339339
```json
340340
"permissions": [
341-
{
342-
"actions": [
343-
"Microsoft.Authorization/*/read",
344-
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
345-
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
346-
"Microsoft.Storage/storageAccounts/blobServices/containers/write"
347-
],
348-
"notActions": [],
349-
"dataActions": [
350-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
351-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
352-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
353-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
354-
],
355-
"notDataActions": []
356-
}
357-
]
341+
{
342+
"actions": [
343+
"Microsoft.Authorization/*/read",
344+
"Microsoft.Compute/disks/read",
345+
"Microsoft.Compute/disks/write",
346+
"Microsoft.Compute/disks/delete",
347+
"Microsoft.Compute/disks/beginGetAccess/action",
348+
"Microsoft.Compute/disks/endGetAccess/action",
349+
"Microsoft.Compute/locations/diskOperations/read",
350+
"Microsoft.Compute/virtualMachines/read",
351+
"Microsoft.Compute/virtualMachines/write",
352+
"Microsoft.Compute/virtualMachines/delete",
353+
"Microsoft.Compute/virtualMachines/instanceView/read",
354+
"Microsoft.Compute/virtualMachines/extensions/read",
355+
"Microsoft.Compute/virtualMachines/extensions/write",
356+
"Microsoft.Compute/virtualMachines/extensions/delete",
357+
"Microsoft.Insights/alertRules/*",
358+
"Microsoft.Network/locations/operationResults/read",
359+
"Microsoft.Network/locations/operations/read",
360+
"Microsoft.Network/locations/usages/read",
361+
"Microsoft.Network/networkInterfaces/delete",
362+
"Microsoft.Network/networkInterfaces/ipconfigurations/read",
363+
"Microsoft.Network/networkInterfaces/join/action",
364+
"Microsoft.Network/networkInterfaces/read",
365+
"Microsoft.Network/networkInterfaces/write",
366+
"Microsoft.Network/networkSecurityGroups/read",
367+
"Microsoft.Network/networkSecurityGroups/securityRules/read",
368+
"Microsoft.Network/publicIPAddresses/delete",
369+
"Microsoft.Network/publicIPAddresses/join/action",
370+
"Microsoft.Network/publicIPAddresses/read",
371+
"Microsoft.Network/publicIPAddresses/write",
372+
"Microsoft.Network/virtualNetworks/read",
373+
"Microsoft.Network/virtualNetworks/subnets/join/action",
374+
"Microsoft.Network/virtualNetworks/subnets/read",
375+
"Microsoft.Resources/deployments/*",
376+
"Microsoft.Resources/subscriptions/resourceGroups/read",
377+
"Microsoft.Storage/checkNameAvailability/read",
378+
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
379+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
380+
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
381+
"Microsoft.Storage/storageAccounts/listKeys/action",
382+
"Microsoft.Storage/storageAccounts/read",
383+
"Microsoft.Storage/storageAccounts/write"
384+
],
385+
"notActions": [],
386+
"dataActions": [
387+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
388+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
389+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
390+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
391+
],
392+
358393
```
359394

360-
Or, add the role assignment on the staging location (Storage Account) to have [Storage account Backup Contributor](./blob-backup-configure-manage.md#grant-permissions-to-the-backup-vault-on-storage-accounts) and [Storage Blob data Contributor](../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) for the successful restore operation.
395+
Or, add the **VM restore operator** role assignment on the staging location (Storage Account) and target Resource Group for the successful restore operation.
361396

362397
:::image type="content" source="./media/backup-azure-arm-restore-vms/add-role-assignment-on-staging-location.png" alt-text="Screenshot for adding the role assignment on the staging location.":::
363398

‎articles/role-based-access-control/built-in-roles/compute.md

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1856,6 +1856,120 @@ View Virtual Machines in the portal and login as a regular user.
18561856
}
18571857
```
18581858

1859+
## Virtual Machine Operator
1860+
1861+
This role is for providing necessary permissions on the staging storage account and target resource group during VM restore operations using Azure Backup.
1862+
1863+
> [!div class="mx-tableFixed"]
1864+
> | Actions | Description |
1865+
> | --- | --- |
1866+
> | Microsoft.Authorization/*/read | Read access to all authorization resources |
1867+
> | Microsoft.Compute/disks/read | Read access to compute disks |
1868+
> | Microsoft.Compute/disks/write | Write access to compute disks |
1869+
> | Microsoft.Compute/disks/delete | Delete access to compute disks |
1870+
> | Microsoft.Compute/disks/beginGetAccess/action | Begin get access action on compute disks |
1871+
> | Microsoft.Compute/disks/endGetAccess/action | End get access action on compute disks |
1872+
> | Microsoft.Compute/locations/diskOperations/read | Read access to disk operations in a location |
1873+
> | Microsoft.Compute/virtualMachines/read | Read access to virtual machines |
1874+
> | Microsoft.Compute/virtualMachines/write | Write access to virtual machines |
1875+
> | Microsoft.Compute/virtualMachines/delete | Delete access to virtual machines |
1876+
> | Microsoft.Compute/virtualMachines/instanceView/read | Read access to virtual machine instance view |
1877+
> | Microsoft.Compute/virtualMachines/extensions/read | Read access to virtual machine extensions |
1878+
> | Microsoft.Compute/virtualMachines/extensions/write | Write access to virtual machine extensions |
1879+
> | Microsoft.Compute/virtualMachines/extensions/delete | Delete access to virtual machine extensions |
1880+
> | Microsoft.Insights/alertRules/* | Full access to alert rules |
1881+
> | Microsoft.Network/locations/operationResults/read | Read access to operation results in a location |
1882+
> | Microsoft.Network/locations/operations/read | Read access to operations in a location |
1883+
> | Microsoft.Network/locations/usages/read | Read access to usage information in a location |
1884+
> | Microsoft.Network/networkInterfaces/delete | Delete access to network interfaces |
1885+
> | Microsoft.Network/networkInterfaces/ipconfigurations/read | Read access to IP configurations of network interfaces |
1886+
> | Microsoft.Network/networkInterfaces/join/action | Join action on network interfaces |
1887+
> | Microsoft.Network/networkInterfaces/read | Read access to network interfaces |
1888+
> | Microsoft.Network/networkInterfaces/write | Write access to network interfaces |
1889+
> | Microsoft.Network/networkSecurityGroups/read | Read access to network security groups |
1890+
> | Microsoft.Network/networkSecurityGroups/securityRules/read | Read access to security rules of network security groups |
1891+
> | Microsoft.Network/publicIPAddresses/delete | Delete access to public IP addresses |
1892+
> | Microsoft.Network/publicIPAddresses/join/action | Join action on public IP addresses |
1893+
> | Microsoft.Network/publicIPAddresses/read | Read access to public IP addresses |
1894+
> | Microsoft.Network/publicIPAddresses/write | Write access to public IP addresses |
1895+
> | Microsoft.Network/virtualNetworks/read | Read access to virtual networks |
1896+
> | Microsoft.Network/virtualNetworks/subnets/join/action | Join action on virtual network subnets |
1897+
> | Microsoft.Network/virtualNetworks/subnets/read | Read access to virtual network subnets |
1898+
> | Microsoft.Resources/deployments/* | Full access to resource deployments |
1899+
> | Microsoft.Resources/subscriptions/resourceGroups/read | Read access to resource groups in a subscription |
1900+
> | Microsoft.Storage/checkNameAvailability/read | Read access to check name availability |
1901+
> | Microsoft.Storage/storageAccounts/blobServices/containers/delete | Delete access to blob service containers in storage accounts |
1902+
> | Microsoft.Storage/storageAccounts/blobServices/containers/read | Read access to blob service containers in storage accounts |
1903+
> | Microsoft.Storage/storageAccounts/blobServices/containers/write | Write access to blob service containers in storage accounts |
1904+
> | Microsoft.Storage/storageAccounts/listKeys/action | List keys action on storage accounts |
1905+
> | Microsoft.Storage/storageAccounts/read | Read access to storage accounts |
1906+
> | Microsoft.Storage/storageAccounts/write | Write access to storage accounts |
1907+
> | NotActions | none |
1908+
> | DataActions | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete | Delete access to blobs in blob service containers |
1909+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read | Read access to blobs in blob service containers |
1910+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write | Write access to blobs in blob service containers |
1911+
> | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action | Add action on blobs in blob service containers |
1912+
> | NotDataActions | none |
1913+
1914+
```json
1915+
"permissions": [
1916+
{
1917+
"actions": [
1918+
"Microsoft.Authorization/*/read",
1919+
"Microsoft.Compute/disks/read",
1920+
"Microsoft.Compute/disks/write",
1921+
"Microsoft.Compute/disks/delete",
1922+
"Microsoft.Compute/disks/beginGetAccess/action",
1923+
"Microsoft.Compute/disks/endGetAccess/action",
1924+
"Microsoft.Compute/locations/diskOperations/read",
1925+
"Microsoft.Compute/virtualMachines/read",
1926+
"Microsoft.Compute/virtualMachines/write",
1927+
"Microsoft.Compute/virtualMachines/delete",
1928+
"Microsoft.Compute/virtualMachines/instanceView/read",
1929+
"Microsoft.Compute/virtualMachines/extensions/read",
1930+
"Microsoft.Compute/virtualMachines/extensions/write",
1931+
"Microsoft.Compute/virtualMachines/extensions/delete",
1932+
"Microsoft.Insights/alertRules/*",
1933+
"Microsoft.Network/locations/operationResults/read",
1934+
"Microsoft.Network/locations/operations/read",
1935+
"Microsoft.Network/locations/usages/read",
1936+
"Microsoft.Network/networkInterfaces/delete",
1937+
"Microsoft.Network/networkInterfaces/ipconfigurations/read",
1938+
"Microsoft.Network/networkInterfaces/join/action",
1939+
"Microsoft.Network/networkInterfaces/read",
1940+
"Microsoft.Network/networkInterfaces/write",
1941+
"Microsoft.Network/networkSecurityGroups/read",
1942+
"Microsoft.Network/networkSecurityGroups/securityRules/read",
1943+
"Microsoft.Network/publicIPAddresses/delete",
1944+
"Microsoft.Network/publicIPAddresses/join/action",
1945+
"Microsoft.Network/publicIPAddresses/read",
1946+
"Microsoft.Network/publicIPAddresses/write",
1947+
"Microsoft.Network/virtualNetworks/read",
1948+
"Microsoft.Network/virtualNetworks/subnets/join/action",
1949+
"Microsoft.Network/virtualNetworks/subnets/read",
1950+
"Microsoft.Resources/deployments/*",
1951+
"Microsoft.Resources/subscriptions/resourceGroups/read",
1952+
"Microsoft.Storage/checkNameAvailability/read",
1953+
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
1954+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
1955+
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
1956+
"Microsoft.Storage/storageAccounts/listKeys/action",
1957+
"Microsoft.Storage/storageAccounts/read",
1958+
"Microsoft.Storage/storageAccounts/write"
1959+
],
1960+
"notActions": [],
1961+
"dataActions": [
1962+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
1963+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
1964+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
1965+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
1966+
],
1967+
1968+
1969+
1970+
```
1971+
1972+
18591973
## Windows 365 Network Interface Contributor
18601974

18611975
This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces.

0 commit comments

Comments
 (0)