Skip to content

Commit aa952b8

Browse files
GitHubber17GitHubber17
authored
Merge pull request #104811 from rolyon/rolyon-rbac-roles-feb
[Azure RBAC] Updates to roles and operations for February
2 parents 7d749af + ffc45fe commit aa952b8

File tree

2 files changed

+253
-51
lines changed

2 files changed

+253
-51
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 91 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.devlang:
1212
ms.topic: reference
1313
ms.tgt_pltfrm:
1414
ms.workload: identity
15-
ms.date: 02/13/2020
15+
ms.date: 02/18/2020
1616
ms.author: rolyon
1717
ms.reviewer: bagovind
1818

@@ -111,6 +111,7 @@ The following table provides a brief description of each built-in role. Click th
111111
> | [Log Analytics Reader](#log-analytics-reader) | Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources. | 73c42c96-874c-492b-b04d-ab87d138a893 |
112112
> | [Logic App Contributor](#logic-app-contributor) | Lets you manage logic apps, but not change access to them. | 87a39d53-fc1b-424a-814c-f7e04687dc9e |
113113
> | [Logic App Operator](#logic-app-operator) | Lets you read, enable, and disable logic apps, but not edit or update them. | 515c2055-d9d4-4321-b1b9-bd0c9a0f79fe |
114+
> | [Managed Application Contributor Role](#managed-application-contributor-role) | Allows for creating managed application resources. | 641177b8-a67a-45b9-a033-47bc880bb21e |
114115
> | [Managed Application Operator Role](#managed-application-operator-role) | Lets you read and perform actions on Managed Application resources | c7393b34-138c-406f-901b-d8cf2b17e6ae |
115116
> | [Managed Applications Reader](#managed-applications-reader) | Lets you read resources in a managed app and request JIT access. | b9331d33-8a36-4f8c-b097-4f54124fdb44 |
116117
> | [Managed Identity Contributor](#managed-identity-contributor) | Create, Read, Update, and Delete User Assigned Identity | e40ec5ca-96e0-45a2-b4ff-59039f2c2b59 |
@@ -129,9 +130,10 @@ The following table provides a brief description of each built-in role. Click th
129130
> | [Resource Policy Contributor](#resource-policy-contributor) | Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy. | 36243c78-bf99-498c-9df9-86d9f8d28608 |
130131
> | [Scheduler Job Collections Contributor](#scheduler-job-collections-contributor) | Lets you manage Scheduler job collections, but not access to them. | 188a0f2f-5c9e-469b-ae67-2aa5ce574b94 |
131132
> | [Search Service Contributor](#search-service-contributor) | Lets you manage Search services, but not access to them. | 7ca78c08-252a-4471-8644-bb5ff32d4ba0 |
132-
> | [Security Admin](#security-admin) | In Security Center only: Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations | fb1c8493-542b-48eb-b624-b4c8fea62acd |
133-
> | [Security Manager (Legacy)](#security-manager-legacy) | This is a legacy role. Please use Security Administrator instead | e3d13bf0-dd5a-482e-ba6b-9b8433878d10 |
134-
> | [Security Reader](#security-reader) | In Security Center only: Can view recommendations and alerts, view security policies, view security states, but cannot make changes | 39bc4728-0917-49c7-9d2c-d95423bc2eb4 |
133+
> | [Security Admin](#security-admin) | Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations. | fb1c8493-542b-48eb-b624-b4c8fea62acd |
134+
> | [Security Assessment Contributor](#security-assessment-contributor) | Lets you push assessments to Security Center | 612c2aa1-cb24-443b-ac28-3ab7272de6f5 |
135+
> | [Security Manager (Legacy)](#security-manager-legacy) | This is a legacy role. Please use Security Admin instead. | e3d13bf0-dd5a-482e-ba6b-9b8433878d10 |
136+
> | [Security Reader](#security-reader) | Can view recommendations and alerts, view security policies, view security states, but cannot make changes. | 39bc4728-0917-49c7-9d2c-d95423bc2eb4 |
135137
> | [Site Recovery Contributor](#site-recovery-contributor) | Lets you manage Site Recovery service except vault creation and role assignment | 6670b86e-a3f7-4917-ac9b-5d6ab1be4567 |
136138
> | [Site Recovery Operator](#site-recovery-operator) | Lets you failover and failback but not perform other Site Recovery management operations | 494ae006-db33-4328-bf46-533a6560a3ca |
137139
> | [Site Recovery Reader](#site-recovery-reader) | Lets you view Site Recovery status but not perform other management operations | dbaa88c4-0c30-4179-9fb3-46319faa6149 |
@@ -163,6 +165,8 @@ The following table provides a brief description of each built-in role. Click th
163165
> | [Virtual Machine User Login](#virtual-machine-user-login) | View Virtual Machines in the portal and login as a regular user. | fb879df8-f326-4884-b1cf-06f3ad86be52 |
164166
> | [Web Plan Contributor](#web-plan-contributor) | Lets you manage the web plans for websites, but not access to them. | 2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b |
165167
> | [Website Contributor](#website-contributor) | Lets you manage websites (not web plans), but not access to them. | de139f84-1756-47ae-9be6-808fbbe84772 |
168+
> | [Workbook Contributor](#workbook-contributor) | Can save shared workbooks. | e8ddcd69-c73f-4f9f-9844-4100522f16ad |
169+
> | [Workbook Reader](#workbook-reader) | Can read workbooks. | b279062a-9be3-42a0-92ae-8b3cf002ec4d |
166170
167171

168172
## Owner
@@ -342,7 +346,7 @@ The following table provides a brief description of each built-in role. Click th
342346
> | Microsoft.ApiManagement/service/restore/action | Restore API Management Service from the specified container in a user provided storage account |
343347
> | Microsoft.ApiManagement/service/updatecertificate/action | Upload SSL certificate for an API Management Service |
344348
> | Microsoft.ApiManagement/service/updatehostname/action | Setup, update or remove custom domain names for an API Management Service |
345-
> | Microsoft.ApiManagement/service/write | Create a new instance of API Management Service |
349+
> | Microsoft.ApiManagement/service/write | Create or Update API Management Service instance |
346350
> | Microsoft.Authorization/*/read | Read authorization |
347351
> | Microsoft.Insights/alertRules/* | Create and manage alert rules |
348352
> | Microsoft.ResourceHealth/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
@@ -605,7 +609,7 @@ The following table provides a brief description of each built-in role. Click th
605609
> | **Id** | b64e21ea-ac4e-4cdf-9dc9-5b892992bee7 |
606610
> | **Actions** | |
607611
> | Microsoft.HybridCompute/machines/read | Read any Azure Arc machines |
608-
> | Microsoft.HybridCompute/machines/write | Write a Azure Arc machines |
612+
> | Microsoft.HybridCompute/machines/write | Writes an Azure Arc machines |
609613
> | Microsoft.GuestConfiguration/guestConfigurationAssignments/read | Get guest configuration assignment. |
610614
> | **NotActions** | |
611615
> | *none* | |
@@ -622,9 +626,9 @@ The following table provides a brief description of each built-in role. Click th
622626
> | **Id** | cd570a14-e51a-42ad-bac8-bafd67325302 |
623627
> | **Actions** | |
624628
> | Microsoft.HybridCompute/machines/read | Read any Azure Arc machines |
625-
> | Microsoft.HybridCompute/machines/write | Write a Azure Arc machines |
626-
> | Microsoft.HybridCompute/machines/delete | Delete a Azure Arc machines |
627-
> | Microsoft.HybridCompute/machines/reconnect/action | Reconnect a Azure Arc machines |
629+
> | Microsoft.HybridCompute/machines/write | Writes an Azure Arc machines |
630+
> | Microsoft.HybridCompute/machines/delete | Deletes an Azure Arc machines |
631+
> | Microsoft.HybridCompute/machines/reconnect/action | Reconnects an Azure Arc machines |
628632
> | Microsoft.HybridCompute/*/read | |
629633
> | **NotActions** | |
630634
> | *none* | |
@@ -686,6 +690,7 @@ The following table provides a brief description of each built-in role. Click th
686690
> | **Id** | 0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8 |
687691
> | **Actions** | |
688692
> | Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action | List the clusterAdmin credential of a managed cluster |
693+
> | Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action | Get a managed cluster access profile by role name using list credential |
689694
> | **NotActions** | |
690695
> | *none* | |
691696
> | **DataActions** | |
@@ -1536,6 +1541,8 @@ The following table provides a brief description of each built-in role. Click th
15361541
> | Microsoft.Databox/jobs/listsecrets/action | |
15371542
> | Microsoft.Databox/jobs/listcredentials/action | Lists the unencrypted credentials related to the order. |
15381543
> | Microsoft.Databox/locations/availableSkus/action | This method returns the list of available skus. |
1544+
> | Microsoft.Databox/locations/validateInputs/action | This method does all type of validations. |
1545+
> | Microsoft.Databox/locations/regionConfiguration/action | This method returns the configurations for the region. |
15391546
> | Microsoft.Databox/locations/validateAddress/action | Validates the shipping address and provides alternate addresses if any. |
15401547
> | Microsoft.ResourceHealth/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
15411548
> | Microsoft.Support/* | Create and manage support tickets |
@@ -1561,6 +1568,7 @@ The following table provides a brief description of each built-in role. Click th
15611568
> | Microsoft.Resources/deployments/* | Create and manage resource group deployments |
15621569
> | Microsoft.Resources/subscriptions/resourceGroups/read | Gets or lists resource groups. |
15631570
> | Microsoft.Support/* | Create and manage support tickets |
1571+
> | Microsoft.EventGrid/eventSubscriptions/write | Create or update an eventSubscription |
15641572
> | **NotActions** | |
15651573
> | *none* | |
15661574
> | **DataActions** | |
@@ -1847,6 +1855,8 @@ The following table provides a brief description of each built-in role. Click th
18471855
> | Microsoft.LabServices/labAccounts/createLab/action | Create a lab in a lab account. |
18481856
> | Microsoft.LabServices/labAccounts/sizes/getRegionalAvailability/action | |
18491857
> | Microsoft.LabServices/labAccounts/getRegionalAvailability/action | Get regional availability information for each size category configured under a lab account |
1858+
> | Microsoft.LabServices/labAccounts/getPricingAndAvailability/action | Get the pricing and availability of combinations of sizes, geographies, and operating systems for the lab account. |
1859+
> | Microsoft.LabServices/labAccounts/getRestrictionsAndUsage/action | Get core restrictions and usage for this subscription |
18501860
> | Microsoft.Resources/subscriptions/resourceGroups/read | Gets or lists resource groups. |
18511861
> | Microsoft.Support/* | Create and manage support tickets |
18521862
> | **NotActions** | |
@@ -1967,6 +1977,25 @@ The following table provides a brief description of each built-in role. Click th
19671977
> | **NotDataActions** | |
19681978
> | *none* | |
19691979
1980+
## Managed Application Contributor Role
1981+
> [!div class="mx-tableFixed"]
1982+
> | | |
1983+
> | --- | --- |
1984+
> | **Description** | Allows for creating managed application resources. |
1985+
> | **Id** | 641177b8-a67a-45b9-a033-47bc880bb21e |
1986+
> | **Actions** | |
1987+
> | */read | Read resources of all types, except secrets. |
1988+
> | Microsoft.Solutions/applications/* | |
1989+
> | Microsoft.Solutions/register/action | Register to Solutions. |
1990+
> | Microsoft.Resources/subscriptions/resourceGroups/* | |
1991+
> | Microsoft.Resources/deployments/* | Create and manage resource group deployments |
1992+
> | **NotActions** | |
1993+
> | *none* | |
1994+
> | **DataActions** | |
1995+
> | *none* | |
1996+
> | **NotDataActions** | |
1997+
> | *none* | |
1998+
19701999
## Managed Application Operator Role
19712000
> [!div class="mx-tableFixed"]
19722001
> | | |
@@ -2333,7 +2362,7 @@ The following table provides a brief description of each built-in role. Click th
23332362
> [!div class="mx-tableFixed"]
23342363
> | | |
23352364
> | --- | --- |
2336-
> | **Description** | In Security Center only: Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations |
2365+
> | **Description** | Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations. |
23372366
> | **Id** | fb1c8493-542b-48eb-b624-b4c8fea62acd |
23382367
> | **Actions** | |
23392368
> | Microsoft.Authorization/*/read | Read roles and role assignments |
@@ -2354,11 +2383,26 @@ The following table provides a brief description of each built-in role. Click th
23542383
> | **NotDataActions** | |
23552384
> | *none* | |
23562385
2386+
## Security Assessment Contributor
2387+
> [!div class="mx-tableFixed"]
2388+
> | | |
2389+
> | --- | --- |
2390+
> | **Description** | Lets you push assessments to Security Center |
2391+
> | **Id** | 612c2aa1-cb24-443b-ac28-3ab7272de6f5 |
2392+
> | **Actions** | |
2393+
> | Microsoft.Security/assessments/write | Create or update security assessments on your subscription |
2394+
> | **NotActions** | |
2395+
> | *none* | |
2396+
> | **DataActions** | |
2397+
> | *none* | |
2398+
> | **NotDataActions** | |
2399+
> | *none* | |
2400+
23572401
## Security Manager (Legacy)
23582402
> [!div class="mx-tableFixed"]
23592403
> | | |
23602404
> | --- | --- |
2361-
> | **Description** | This is a legacy role. Please use Security Administrator instead |
2405+
> | **Description** | This is a legacy role. Please use Security Admin instead. |
23622406
> | **Id** | e3d13bf0-dd5a-482e-ba6b-9b8433878d10 |
23632407
> | **Actions** | |
23642408
> | Microsoft.Authorization/*/read | Read roles and role assignments |
@@ -2382,7 +2426,7 @@ The following table provides a brief description of each built-in role. Click th
23822426
> [!div class="mx-tableFixed"]
23832427
> | | |
23842428
> | --- | --- |
2385-
> | **Description** | In Security Center only: Can view recommendations and alerts, view security policies, view security states, but cannot make changes |
2429+
> | **Description** | Can view recommendations and alerts, view security policies, view security states, but cannot make changes. |
23862430
> | **Id** | 39bc4728-0917-49c7-9d2c-d95423bc2eb4 |
23872431
> | **Actions** | |
23882432
> | Microsoft.Authorization/*/read | Read roles and role assignments |
@@ -3110,6 +3154,9 @@ The following table provides a brief description of each built-in role. Click th
31103154
> | Microsoft.Compute/locations/* | Create and manage compute locations |
31113155
> | Microsoft.Compute/virtualMachines/* | Create and manage virtual machines |
31123156
> | Microsoft.Compute/virtualMachineScaleSets/* | Create and manage virtual machine scale sets |
3157+
> | Microsoft.Compute/disks/write | Creates a new Disk or updates an existing one |
3158+
> | Microsoft.Compute/disks/read | Get the properties of a Disk |
3159+
> | Microsoft.Compute/disks/delete | Deletes the Disk |
31133160
> | Microsoft.DevTestLab/schedules/* | |
31143161
> | Microsoft.Insights/alertRules/* | Create and manage Insights alert rules |
31153162
> | Microsoft.Network/applicationGateways/backendAddressPools/join/action | Joins an application gateway backend address pool. Not Alertable. |
@@ -3217,6 +3264,38 @@ The following table provides a brief description of each built-in role. Click th
32173264
> | **NotDataActions** | |
32183265
> | *none* | |
32193266
3267+
## Workbook Contributor
3268+
> [!div class="mx-tableFixed"]
3269+
> | | |
3270+
> | --- | --- |
3271+
> | **Description** | Can save shared workbooks. |
3272+
> | **Id** | e8ddcd69-c73f-4f9f-9844-4100522f16ad |
3273+
> | **Actions** | |
3274+
> | Microsoft.Insights/workbooks/write | Create or update a workbook |
3275+
> | Microsoft.Insights/workbooks/delete | Delete a workbook |
3276+
> | Microsoft.Insights/workbooks/read | Read a workbook |
3277+
> | **NotActions** | |
3278+
> | *none* | |
3279+
> | **DataActions** | |
3280+
> | *none* | |
3281+
> | **NotDataActions** | |
3282+
> | *none* | |
3283+
3284+
## Workbook Reader
3285+
> [!div class="mx-tableFixed"]
3286+
> | | |
3287+
> | --- | --- |
3288+
> | **Description** | Can read workbooks. |
3289+
> | **Id** | b279062a-9be3-42a0-92ae-8b3cf002ec4d |
3290+
> | **Actions** | |
3291+
> | microsoft.insights/workbooks/read | Read a workbook |
3292+
> | **NotActions** | |
3293+
> | *none* | |
3294+
> | **DataActions** | |
3295+
> | *none* | |
3296+
> | **NotDataActions** | |
3297+
> | *none* | |
3298+
32203299
## Next steps
32213300

32223301
- [Match resource provider to service](../azure-resource-manager/management/azure-services-resource-providers.md)

0 commit comments

Comments
 (0)