Skip to content

Commit a65d801

Browse files
PMEds28PMEds28
authored
Merge pull request #114212 from rolyon/rolyon-rbac-rest-examples
[Azure RBAC] REST example output
2 parents be7e969 + 87b6ae6 commit a65d801

File tree

3 files changed

+180
-7
lines changed

3 files changed

+180
-7
lines changed

‎articles/role-based-access-control/role-assignments-list-rest.md

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.workload: multiple
1313
ms.tgt_pltfrm: rest-api
1414
ms.devlang: na
1515
ms.topic: conceptual
16-
ms.date: 03/19/2020
16+
ms.date: 05/06/2020
1717
ms.author: rolyon
1818
ms.reviewer: bagovind
1919

@@ -57,6 +57,35 @@ In Azure RBAC, to list access, you list the role assignments. To list role assig
5757
> | `$filter=atScope()+and+assignedTo('{objectId}')` | Lists role assignments for the specified user or service principal and at the specified scope. |
5858
> | `$filter=principalId+eq+'{objectId}'` | Lists role assignments for a specified user, group, or service principal. |
5959
60+
The following request lists all role assignments for the specified user at subscription scope:
61+
62+
```http
63+
GET https://management.azure.com/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleAssignments?api-version=2015-07-01&$filter=atScope()+and+assignedTo('{objectId1}')
64+
```
65+
66+
The following shows an example of the output:
67+
68+
```json
69+
{
70+
"value": [
71+
{
72+
"properties": {
73+
"roleDefinitionId": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
74+
"principalId": "{objectId1}",
75+
"scope": "/subscriptions/{subscriptionId1}",
76+
"createdOn": "2019-01-15T21:08:45.4904312Z",
77+
"updatedOn": "2019-01-15T21:08:45.4904312Z",
78+
"createdBy": "{createdByObjectId1}",
79+
"updatedBy": "{updatedByObjectId1}"
80+
},
81+
"id": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId1}",
82+
"type": "Microsoft.Authorization/roleAssignments",
83+
"name": "{roleAssignmentId1}"
84+
}
85+
]
86+
}
87+
```
88+
6089
## Next steps
6190

6291
- [Add or remove Azure role assignments using the REST API](role-assignments-rest.md)

‎articles/role-based-access-control/role-assignments-rest.md

Lines changed: 64 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.workload: multiple
1313
ms.tgt_pltfrm: rest-api
1414
ms.devlang: na
1515
ms.topic: conceptual
16-
ms.date: 03/19/2020
16+
ms.date: 05/06/2020
1717
ms.author: rolyon
1818
ms.reviewer: bagovind
1919

@@ -39,7 +39,7 @@ In Azure RBAC, to grant access, you add a role assignment. To add a role assignm
3939
1. Start with the following request and body:
4040

4141
```http
42-
PUT https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}?api-version=2015-07-01
42+
PUT https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}?api-version=2015-07-01
4343
```
4444
4545
```json
@@ -63,7 +63,7 @@ In Azure RBAC, to grant access, you add a role assignment. To add a role assignm
6363
6464
In the previous example, microsoft.web is a resource provider that refers to an App Service instance. Similarly, you can use any other resource providers and specify the scope. For more information, see [Azure Resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md) and supported [Azure Resource Manager resource provider operations](resource-provider-operations.md).
6565
66-
1. Replace *{roleAssignmentName}* with the GUID identifier of the role assignment.
66+
1. Replace *{roleAssignmentId}* with the GUID identifier of the role assignment.
6767
6868
1. Within the request body, replace *{scope}* with the scope for the role assignment.
6969
@@ -79,6 +79,40 @@ In Azure RBAC, to grant access, you add a role assignment. To add a role assignm
7979
8080
1. Replace *{principalId}* with the object identifier of the user, group, or service principal that will be assigned the role.
8181
82+
The following request and body assigns the [Backup Reader](built-in-roles.md#backup-reader) role to a user at subscription scope:
83+
84+
```http
85+
PUT https://management.azure.com/subscriptions/{subscriptionId1}/providers/microsoft.authorization/roleassignments/{roleAssignmentId1}?api-version=2015-07-01
86+
```
87+
88+
```json
89+
{
90+
"properties": {
91+
"roleDefinitionId": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions/a795c7a0-d4a2-40c1-ae25-d81f01202912",
92+
"principalId": "{objectId1}"
93+
}
94+
}
95+
```
96+
97+
The following shows an example of the output:
98+
99+
```json
100+
{
101+
"properties": {
102+
"roleDefinitionId": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions/a795c7a0-d4a2-40c1-ae25-d81f01202912",
103+
"principalId": "{objectId1}",
104+
"scope": "/subscriptions/{subscriptionId1}",
105+
"createdOn": "2020-05-06T23:55:23.7679147Z",
106+
"updatedOn": "2020-05-06T23:55:23.7679147Z",
107+
"createdBy": null,
108+
"updatedBy": "{updatedByObjectId1}"
109+
},
110+
"id": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId1}",
111+
"type": "Microsoft.Authorization/roleAssignments",
112+
"name": "{roleAssignmentId1}"
113+
}
114+
```
115+
82116
## Remove a role assignment
83117

84118
In Azure RBAC, to remove access, you remove a role assignment. To remove a role assignment, use the [Role Assignments - Delete](/rest/api/authorization/roleassignments/delete) REST API. To call this API, you must have access to the `Microsoft.Authorization/roleAssignments/delete` operation. Of the built-in roles, only [Owner](built-in-roles.md#owner) and [User Access Administrator](built-in-roles.md#user-access-administrator) are granted access to this operation.
@@ -88,7 +122,7 @@ In Azure RBAC, to remove access, you remove a role assignment. To remove a role
88122
1. Start with the following request:
89123

90124
```http
91-
DELETE https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}?api-version=2015-07-01
125+
DELETE https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}?api-version=2015-07-01
92126
```
93127
94128
1. Within the URI, replace *{scope}* with the scope for removing the role assignment.
@@ -101,7 +135,32 @@ In Azure RBAC, to remove access, you remove a role assignment. To remove a role
101135
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1` | Resource group |
102136
> | `subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/providers/microsoft.web/sites/mysite1` | Resource |
103137
104-
1. Replace *{roleAssignmentName}* with the GUID identifier of the role assignment.
138+
1. Replace *{roleAssignmentId}* with the GUID identifier of the role assignment.
139+
140+
The following request removes the specified role assignment at subscription scope:
141+
142+
```http
143+
DELETE https://management.azure.com/subscriptions/{subscriptionId1}/providers/microsoft.authorization/roleassignments/{roleAssignmentId1}?api-version=2015-07-01
144+
```
145+
146+
The following shows an example of the output:
147+
148+
```json
149+
{
150+
"properties": {
151+
"roleDefinitionId": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions/a795c7a0-d4a2-40c1-ae25-d81f01202912",
152+
"principalId": "{objectId1}",
153+
"scope": "/subscriptions/{subscriptionId1}",
154+
"createdOn": "2020-05-06T23:55:24.5379478Z",
155+
"updatedOn": "2020-05-06T23:55:24.5379478Z",
156+
"createdBy": "{createdByObjectId1}",
157+
"updatedBy": "{updatedByObjectId1}"
158+
},
159+
"id": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId1}",
160+
"type": "Microsoft.Authorization/roleAssignments",
161+
"name": "{roleAssignmentId1}"
162+
}
163+
```
105164

106165
## Next steps
107166

‎articles/role-based-access-control/role-definitions-list.md

Lines changed: 86 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.devlang: na
1212
ms.topic: conceptual
1313
ms.tgt_pltfrm: na
1414
ms.workload: identity
15-
ms.date: 03/19/2020
15+
ms.date: 05/06/2020
1616
ms.author: rolyon
1717
ms.reviewer: bagovind
1818
---
@@ -340,6 +340,55 @@ To list role definitions, use the [Role Definitions - List](/rest/api/authorizat
340340
> | `$filter=atScopeAndBelow()` | Lists role definitions for the specified scope and any subscopes. |
341341
> | `$filter=type+eq+'{type}'` | Lists role definitions of the specified type. Type of role can be `CustomRole` or `BuiltInRole`. |
342342
343+
The following request lists custom role definitions at subscription scope:
344+
345+
```http
346+
GET https://management.azure.com/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions?api-version=2015-07-01&$filter=type+eq+'CustomRole'
347+
```
348+
349+
The following shows an example of the output:
350+
351+
```json
352+
{
353+
"value": [
354+
{
355+
"properties": {
356+
"roleName": "Billing Reader Plus",
357+
"type": "CustomRole",
358+
"description": "Read billing data and download invoices",
359+
"assignableScopes": [
360+
"/subscriptions/{subscriptionId1}"
361+
],
362+
"permissions": [
363+
{
364+
"actions": [
365+
"Microsoft.Authorization/*/read",
366+
"Microsoft.Billing/*/read",
367+
"Microsoft.Commerce/*/read",
368+
"Microsoft.Consumption/*/read",
369+
"Microsoft.Management/managementGroups/read",
370+
"Microsoft.CostManagement/*/read",
371+
"Microsoft.Billing/invoices/download/action",
372+
"Microsoft.CostManagement/exports/*"
373+
],
374+
"notActions": [
375+
"Microsoft.CostManagement/exports/delete"
376+
]
377+
}
378+
],
379+
"createdOn": "2020-02-21T04:49:13.7679452Z",
380+
"updatedOn": "2020-02-21T04:49:13.7679452Z",
381+
"createdBy": "{createdByObjectId1}",
382+
"updatedBy": "{updatedByObjectId1}"
383+
},
384+
"id": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId1}",
385+
"type": "Microsoft.Authorization/roleDefinitions",
386+
"name": "{roleDefinitionId1}"
387+
}
388+
]
389+
}
390+
```
391+
343392
### List a role definition
344393

345394
To list the details of a specific role, use the [Role Definitions - Get](/rest/api/authorization/roledefinitions/get) or [Role Definitions - Get By Id](/rest/api/authorization/roledefinitions/getbyid) REST API.
@@ -368,6 +417,42 @@ To list the details of a specific role, use the [Role Definitions - Get](/rest/a
368417
369418
1. Replace *{roleDefinitionId}* with the role definition identifier.
370419
420+
The following request lists the [Reader](built-in-roles.md#reader) role definition:
421+
422+
```http
423+
GET https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7?api-version=2015-07-01
424+
```
425+
426+
The following shows an example of the output:
427+
428+
```json
429+
{
430+
"properties": {
431+
"roleName": "Reader",
432+
"type": "BuiltInRole",
433+
"description": "Lets you view everything, but not make any changes.",
434+
"assignableScopes": [
435+
"/"
436+
],
437+
"permissions": [
438+
{
439+
"actions": [
440+
"*/read"
441+
],
442+
"notActions": []
443+
}
444+
],
445+
"createdOn": "2015-02-02T21:55:09.8806423Z",
446+
"updatedOn": "2019-02-05T21:24:35.7424745Z",
447+
"createdBy": null,
448+
"updatedBy": null
449+
},
450+
"id": "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
451+
"type": "Microsoft.Authorization/roleDefinitions",
452+
"name": "acdd72a7-3385-48ef-bd42-f606fba81ae7"
453+
}
454+
```
455+
371456
## Next steps
372457

373458
- [Azure built-in roles](built-in-roles.md)

0 commit comments

Comments
 (0)