Skip to content

Commit 99f1124

Browse files
wtnleewtnlee
committed
updated custom roles
1 parent 9bdb5e1 commit 99f1124

File tree

1 file changed

+52
-41
lines changed

1 file changed

+52
-41
lines changed

‎articles/virtual-wan/roles-permissions.md

Lines changed: 52 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -29,36 +29,39 @@ For more information, see [Steps to create a custom role](../role-based-access-c
2929
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities interacting with Virtual WAN have the necessary permissions.
3030
To add any missing permissions listed here, see [Update a custom role](../role-based-access-control/custom-roles-portal.md#update-a-custom-role).
3131

32-
The following custom roles are a few example roles you can create in your tenant if you don't want to leverage more generic built-in roles such as Network Contributor or Contributor.
32+
The following custom roles are a few example roles you can create in your tenant if you don't want to leverage more generic built-in roles such as Network Contributor or Contributor. You can download and save the sample roles asJSON files and upload the JSON file to Azure Portal when creating custom roles in your tenant. Ensure the assignable scopes for the custom roles are set properly for your networking resource subscription(s).
3333

3434
### Virtual WAN Administrator
3535

3636
The Virtual WAN Administrator role has the ability to perform all operations related to the Virtual Hub, including managing connections to Virtual WAN and configuring routing.
3737

3838
```
3939
{
40-
"Name": "Virtual WAN Administrator",
41-
"IsCustom": true,
42-
"Description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
43-
"Actions": [
44-
"Microsoft.Network/virtualWans/*",
45-
"Microsoft.Network/virtualHubs/*",
46-
"Microsoft.Network/azureFirewalls/read",
47-
"Microsoft.Network/networkVirtualAppliances/*/read",
48-
"Microsoft.Network/securityPartnerProviders/*/read",
49-
"Microsoft.Network/expressRouteGateways/*",
50-
"Microsoft.Network/vpnGateways/*",
51-
"Microsoft.Network/p2sVpnGateways/*",
52-
"Microsoft.Network/virtualNetworks/peer/action"
53-
54-
],
55-
"NotActions": [],
56-
"DataActions": [],
57-
"NotDataActions": [],
58-
"AssignableScopes": [
59-
"/subscriptions/{subscriptionId1}",
60-
"/subscriptions/{subscriptionId2}"
61-
]
40+
"properties": {
41+
"roleName": "Virtual WAN Administrator",
42+
"description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
43+
"assignableScopes": [
44+
"/subscriptions/<>"
45+
],
46+
"permissions": [
47+
{
48+
"actions": [
49+
"Microsoft.Network/virtualWans/*",
50+
"Microsoft.Network/virtualHubs/*",
51+
"Microsoft.Network/azureFirewalls/read",
52+
"Microsoft.Network/networkVirtualAppliances/*/read",
53+
"Microsoft.Network/securityPartnerProviders/*/read",
54+
"Microsoft.Network/expressRouteGateways/*",
55+
"Microsoft.Network/vpnGateways/*",
56+
"Microsoft.Network/p2sVpnGateways/*",
57+
"Microsoft.Network/virtualNetworks/peer/action"
58+
],
59+
"notActions": [],
60+
"dataActions": [],
61+
"notDataActions": []
62+
}
63+
]
64+
}
6265
}
6366
```
6467

@@ -68,26 +71,34 @@ The Virtual WAN reader role has the ability to view and monitor all Virtual WAN-
6871

6972
```
7073
{
71-
"Name": "Virtual WAN Reader",
72-
"IsCustom": true,
73-
"Description": "Can read and monitor all Virtual WAN resources, but cannot modify Virtual WAN resources.",
74-
"Actions": [
75-
"Microsoft.Network/virtualWans/*/read",
76-
"Microsoft.Network/virtualHubs/*/read",
77-
"Microsoft.Network/expressRouteGateways/*/read",
78-
"Microsoft.Network/vpnGateways/*/read",
79-
"Microsoft.Network/p2sVpnGateways/*/read"
80-
"Microsoft.Network/networkVirtualAppliances/*/read
81-
],
82-
"NotActions": [],
83-
"DataActions": [],
84-
"NotDataActions": [],
85-
"AssignableScopes": [
86-
"/subscriptions/{subscriptionId1}",
87-
"/subscriptions/{subscriptionId2}"
88-
]
74+
"properties": {
75+
"roleName": "Virtual WAN reader",
76+
"description": "Can perform all operations related to the Virtual WAN, including managing connections to Virtual WAN and configuring routing in each hub.",
77+
"assignableScopes": [
78+
"/subscriptions/<>"
79+
],
80+
"permissions": [
81+
{
82+
"actions": [
83+
"Microsoft.Network/virtualWans/*",
84+
"Microsoft.Network/virtualHubs/*",
85+
"Microsoft.Network/azureFirewalls/read",
86+
"Microsoft.Network/networkVirtualAppliances/*/read",
87+
"Microsoft.Network/securityPartnerProviders/*/read",
88+
"Microsoft.Network/expressRouteGateways/*",
89+
"Microsoft.Network/vpnGateways/*",
90+
"Microsoft.Network/p2sVpnGateways/*",
91+
"Microsoft.Network/virtualNetworks/peer/action"
92+
],
93+
"notActions": [],
94+
"dataActions": [],
95+
"notDataActions": []
96+
}
97+
]
98+
}
8999
}
90100
```
101+
91102
## Required Permissions
92103

93104
Creating or updating Virtual WAN resources requires you to have the proper permission(s) to create that Virtual WAN resource type. In some scenarios, having permissions to create or update that resource type is sufficient. However, in many scenarios, updating a Virtual WAN resource that has a **reference** to another Azure resource requires you to have permissions over both the created resource **and** any referenced resources.

0 commit comments

Comments
 (0)