|
| 1 | +--- |
| 2 | +title: Built-in RBAC Roles for IoT Operations |
| 3 | +description: Learn about the built-in RBAC roles for Azure IoT Operations and how to use them to control access to resources. |
| 4 | +author: SoniaLopezBravo |
| 5 | +ms.author: sonialopez |
| 6 | +ms.topic: reference |
| 7 | +ms.date: 07/29/2025 |
| 8 | + |
| 9 | +#CustomerIntent: As an IT administrator, I want to configure Azure RBAC built-in roles on resources in my Azure IoT Operations instance to control access to them. |
| 10 | +--- |
| 11 | + |
| 12 | +# Built-in RBAC roles for IoT Operations |
| 13 | + |
| 14 | +Azure IoT Operations (AIO) offers two built-in roles designed to simplify and secure access management for AIO resources: Azure IoT Operations Administrator and Azure IoT Operations Onboarding. If your scenario requires more granular access, you can [create a custom RBAC role](../reference/custom-rbac.md). |
| 15 | + |
| 16 | +> [!IMPORTANT] |
| 17 | +> The built-in roles for AIO streamline access management for AIO resources, but don't automatically grant permissions for all required Azure dependencies. AIO relies on several Azure services, such as Azure Key Vault, Azure Storage, Azure Arc, and others. Always review and assign the necessary additional roles to ensure users have end-to-end access for successful AIO deployment and operation. |
| 18 | +
|
| 19 | +## Azure IoT Operations Administrator role |
| 20 | + |
| 21 | +The Azure IoT Operations Administrator role provides comprehensive permissions to manage and operate all Azure IoT Operations components. Assign this role to users who need full access to use AIO resources. To support deployment and ongoing management of AIO, users require additional permissions. If a user only needs to use AIO, you can assign the Administrator role alone. |
| 22 | + |
| 23 | +When assigning this built-in role, you need to ensure that users have the following permissions: |
| 24 | + |
| 25 | +- Azure Edge Hardware Center Administrator: This role grants access to manage and take action as an edge order administrator. It is used for ordering and managing Azure Stack Edge devices. |
| 26 | +- Azure Arc Enabled Kubernetes Cluster User Role: This role is used to manage Azure Arc-enabled Kubernetes clusters by providing permission to write deployments, manage subscriptions, and handle connected clusters and extensions. |
| 27 | +- Key Vault Administrator: This role allows the user to manage all aspects of Azure Key Vaults, including creating, maintaining, viewing, and deleting keys, certificates, and secrets. |
| 28 | +- Kubernetes Extension Contributor: This role allows users to manage Kubernetes extensions, including creating, updating, and deleting extensions. |
| 29 | +- Managed Identity Contributor: This role allows the user to manage managed identities, including creating, updating, and deleting user-assigned managed identities. |
| 30 | +- Monitoring Contributor: This role allows the user to read all monitoring data and update monitoring settings. |
| 31 | +- Resource Group Contributor: This role grants permissions to manage resources within a resource group, including creating, updating, and deleting resources. |
| 32 | +- Secrets Store Extension Owner: This role allows the user to manage the Secrets Store extension, which synchronizes secrets from Azure Key Vault to Kubernetes clusters. |
| 33 | +- Storage Account Contributor: This role allows the user to manage storage accounts, including creating, updating, and deleting storage accounts, as well as managing access keys and other settings. |
| 34 | + |
| 35 | +## Azure IoT Operations Onboarding role |
| 36 | + |
| 37 | +AIO Onboarding is a specialized role that provides the necessary permissions to deploy Azure IoT Operations components. |
| 38 | + |
| 39 | +When assigning this built-in role, you need to ensure that users have the following permissions: |
| 40 | + |
| 41 | +- Azure Resource Bridge Deployment Role: This role is used to manage the deployment of the Azure Resource Bridge. It includes permissions to read, write, and delete various resources related to the Resource Bridge, such as appliances, locations, and telemetry configurations. |
| 42 | +- Kubernetes Cluster – Azure Arc Onboarding: This role is used for onboarding Kubernetes clusters to Azure Arc. |
| 43 | +- Storage Account Contributor: This role allows the user to manage storage accounts, including creating, updating, and deleting storage accounts, as well as managing access keys and other settings. |
| 44 | +- Resource Group Contributor Role: This role grants permissions to manage resources within a resource group, including creating, updating, and deleting resources. |
| 45 | +- Azure Arc Enabled Kubernetes Cluster User Role: This role is used to manage Azure Arc-enabled Kubernetes clusters by providing permission to write deployments, manage subscriptions, and handle connected clusters and extensions. |
| 46 | + |
| 47 | + |
0 commit comments