Skip to content

Commit ccfb43d

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #267158 from rolyon/rolyon-rbac-roles-reservations
[Azure RBAC] Reservations roles
2 parents b3a4302 + 8115bcf commit ccfb43d

File tree

2 files changed

+98
-0
lines changed

2 files changed

+98
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,8 @@ The following table provides a brief description of each built-in role. Click th
414414
> | <a name='policy-insights-data-writer-preview'></a>[Policy Insights Data Writer (Preview)](./built-in-roles/management-and-governance.md#policy-insights-data-writer-preview) | Allows read access to resource policies and write access to resource component policy events. | 66bb4e9e-b016-4a94-8249-4c0511c2be84 |
415415
> | <a name='quota-request-operator'></a>[Quota Request Operator](./built-in-roles/management-and-governance.md#quota-request-operator) | Read and create quota requests, get quota request status, and create support tickets. | 0e5f05e5-9ab9-446b-b98d-1e2157c94125 |
416416
> | <a name='reservation-purchaser'></a>[Reservation Purchaser](./built-in-roles/management-and-governance.md#reservation-purchaser) | Lets you purchase reservations | f7b75c60-3036-4b75-91c3-6b41c27c1689 |
417+
> | <a name='reservations-administrator'></a>[Reservations Administrator](./built-in-roles/management-and-governance.md#reservations-administrator) | Lets one read and manage all the reservations in a tenant | a8889054-8d42-49c9-bc1c-52486c10e7cd |
418+
> | <a name='reservations-reader'></a>[Reservations Reader](./built-in-roles/management-and-governance.md#reservations-reader) | Lets one read all the reservations in a tenant | 582fc458-8989-419f-a480-75249bc5db7e |
417419
> | <a name='resource-policy-contributor'></a>[Resource Policy Contributor](./built-in-roles/management-and-governance.md#resource-policy-contributor) | Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy. | 36243c78-bf99-498c-9df9-86d9f8d28608 |
418420
> | <a name='site-recovery-contributor'></a>[Site Recovery Contributor](./built-in-roles/management-and-governance.md#site-recovery-contributor) | Lets you manage Site Recovery service except vault creation and role assignment | 6670b86e-a3f7-4917-ac9b-5d6ab1be4567 |
419421
> | <a name='site-recovery-operator'></a>[Site Recovery Operator](./built-in-roles/management-and-governance.md#site-recovery-operator) | Lets you failover and failback but not perform other Site Recovery management operations | 494ae006-db33-4328-bf46-533a6560a3ca |

‎articles/role-based-access-control/built-in-roles/management-and-governance.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1380,6 +1380,102 @@ Lets you purchase reservations
13801380
}
13811381
```
13821382

1383+
## Reservations Administrator
1384+
1385+
Lets one read and manage all the reservations in a tenant
1386+
1387+
[Learn more](/azure/cost-management-billing/reservations/view-reservations)
1388+
1389+
> [!div class="mx-tableFixed"]
1390+
> | Actions | Description |
1391+
> | --- | --- |
1392+
> | [Microsoft.Capacity](../permissions/management-and-governance.md#microsoftcapacity)/*/read | |
1393+
> | [Microsoft.Capacity](../permissions/management-and-governance.md#microsoftcapacity)/*/action | |
1394+
> | [Microsoft.Capacity](../permissions/management-and-governance.md#microsoftcapacity)/*/write | |
1395+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |
1396+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |
1397+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
1398+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
1399+
> | **NotActions** | |
1400+
> | *none* | |
1401+
> | **DataActions** | |
1402+
> | *none* | |
1403+
> | **NotDataActions** | |
1404+
> | *none* | |
1405+
1406+
```json
1407+
{
1408+
"assignableScopes": [
1409+
"/providers/Microsoft.Capacity"
1410+
],
1411+
"description": "Lets one read and manage all the reservations in a tenant",
1412+
"id": "/providers/Microsoft.Authorization/roleDefinitions/a8889054-8d42-49c9-bc1c-52486c10e7cd",
1413+
"name": "a8889054-8d42-49c9-bc1c-52486c10e7cd",
1414+
"permissions": [
1415+
{
1416+
"actions": [
1417+
"Microsoft.Capacity/*/read",
1418+
"Microsoft.Capacity/*/action",
1419+
"Microsoft.Capacity/*/write",
1420+
"Microsoft.Authorization/roleAssignments/read",
1421+
"Microsoft.Authorization/roleDefinitions/read",
1422+
"Microsoft.Authorization/roleAssignments/write",
1423+
"Microsoft.Authorization/roleAssignments/delete"
1424+
],
1425+
"notActions": [],
1426+
"dataActions": [],
1427+
"notDataActions": []
1428+
}
1429+
],
1430+
"roleName": "Reservations Administrator",
1431+
"roleType": "BuiltInRole",
1432+
"type": "Microsoft.Authorization/roleDefinitions"
1433+
}
1434+
```
1435+
1436+
## Reservations Reader
1437+
1438+
Lets one read all the reservations in a tenant
1439+
1440+
[Learn more](/azure/cost-management-billing/reservations/view-reservations)
1441+
1442+
> [!div class="mx-tableFixed"]
1443+
> | Actions | Description |
1444+
> | --- | --- |
1445+
> | [Microsoft.Capacity](../permissions/management-and-governance.md#microsoftcapacity)/*/read | |
1446+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |
1447+
> | **NotActions** | |
1448+
> | *none* | |
1449+
> | **DataActions** | |
1450+
> | *none* | |
1451+
> | **NotDataActions** | |
1452+
> | *none* | |
1453+
1454+
```json
1455+
{
1456+
"assignableScopes": [
1457+
"/providers/Microsoft.Capacity"
1458+
],
1459+
"description": "Lets one read all the reservations in a tenant",
1460+
"id": "/providers/Microsoft.Authorization/roleDefinitions/582fc458-8989-419f-a480-75249bc5db7e",
1461+
"name": "582fc458-8989-419f-a480-75249bc5db7e",
1462+
"permissions": [
1463+
{
1464+
"actions": [
1465+
"Microsoft.Capacity/*/read",
1466+
"Microsoft.Authorization/roleAssignments/read"
1467+
],
1468+
"notActions": [],
1469+
"dataActions": [],
1470+
"notDataActions": []
1471+
}
1472+
],
1473+
"roleName": "Reservations Reader",
1474+
"roleType": "BuiltInRole",
1475+
"type": "Microsoft.Authorization/roleDefinitions"
1476+
}
1477+
```
1478+
13831479
## Resource Policy Contributor
13841480

13851481
Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy.

0 commit comments

Comments
 (0)