Skip to content

Commit d06bf3d

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #265958 from rolyon/rolyon-rbac-role-definitions-properties
[Azure RBAC] Role definitions properties
2 parents 14de418 + b45a75d commit d06bf3d

File tree

1 file changed

+113
-68
lines changed

1 file changed

+113
-68
lines changed

‎articles/role-based-access-control/role-definitions.md

Lines changed: 113 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: rolyon
66
manager: amycolannino
77
ms.service: role-based-access-control
88
ms.topic: conceptual
9-
ms.date: 11/06/2023
9+
ms.date: 02/12/2024
1010
ms.author: rolyon
1111
ms.custom:
1212
---
@@ -30,35 +30,53 @@ NotActions []
3030
DataActions []
3131
NotDataActions []
3232
AssignableScopes []
33+
Condition
34+
ConditionVersion
3335
```
3436

35-
The following shows an example of the properties in a role definition when displayed using the [Azure portal](role-definitions-list.md#azure-portal), [Azure CLI](role-definitions-list.md#azure-cli), or the [REST API](role-definitions-list.md#rest-api):
37+
The following shows an example of the properties in a role definition when displayed using the [Azure CLI](role-definitions-list.md#azure-cli) or [REST API](role-definitions-list.md#rest-api):
3638

3739
```
3840
roleName
3941
name
42+
id
43+
roleType
4044
type
4145
description
4246
actions []
4347
notActions []
4448
dataActions []
4549
notDataActions []
4650
assignableScopes []
51+
condition
52+
conditionVersion
53+
createdOn
54+
updatedOn
55+
createdBy
56+
updatedBy
4757
```
4858

4959
The following table describes what the role properties mean.
5060

5161
| Property | Description |
5262
| --- | --- |
53-
| `Name`</br>`roleName` | The display name of the role. |
54-
| `Id`</br>`name` | The unique ID of the role. Built-in roles have the same role ID across clouds. |
55-
| `IsCustom`</br>`roleType` | Indicates whether this is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
56-
| `Description`</br>`description` | The description of the role. |
57-
| `Actions`</br>`actions` | An array of strings that specifies the control plane actions that the role allows to be performed. |
58-
| `NotActions`</br>`notActions` | An array of strings that specifies the control plane actions that are excluded from the allowed `Actions`. |
59-
| `DataActions`</br>`dataActions` | An array of strings that specifies the data plane actions that the role allows to be performed to your data within that object. |
60-
| `NotDataActions`</br>`notDataActions` | An array of strings that specifies the data plane actions that are excluded from the allowed `DataActions`. |
61-
| `AssignableScopes`</br>`assignableScopes` | An array of strings that specifies the scopes that the role is available for assignment. |
63+
| `Name`</br>`roleName` | Display name of the role. |
64+
| `Id`</br>`name` | Unique ID of the role. Built-in roles have the same role ID across clouds. |
65+
| `id` | Fully qualified unique ID of the role. |
66+
| `IsCustom`</br>`roleType` | Indicates whether this role is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
67+
| `type` | Type of object. Set to `Microsoft.Authorization/roleDefinitions`. |
68+
| `Description`</br>`description` | Description of the role. |
69+
| `Actions`</br>`actions` | Array of strings that specifies the control plane actions that the role allows to be performed. |
70+
| `NotActions`</br>`notActions` | Array of strings that specifies the control plane actions that are excluded from the allowed `Actions`. |
71+
| `DataActions`</br>`dataActions` | Array of strings that specifies the data plane actions that the role allows to be performed to your data within that object. |
72+
| `NotDataActions`</br>`notDataActions` | Array of strings that specifies the data plane actions that are excluded from the allowed `DataActions`. |
73+
| `AssignableScopes`</br>`assignableScopes` | Array of strings that specifies the scopes that the role is available for assignment. |
74+
| `Condition`<br/>`condition` | For built-in roles, condition statement based on one or more actions in role definition. |
75+
| `ConditionVersion`<br/>`conditionVersion` | Condition version number. Defaults to 2.0 and is the only supported version. |
76+
| `createdOn` | Date and time role was created. |
77+
| `updatedOn` | Date and time role was last updated. |
78+
| `createdBy` | For custom roles, principal that created role. |
79+
| `updatedBy` | For custom roles, principal that updated role. |
6280

6381
### Actions format
6482

@@ -87,7 +105,7 @@ Contributor role as displayed in [Azure PowerShell](role-definitions-list.md#azu
87105
"Name": "Contributor",
88106
"Id": "b24988ac-6180-42a0-ab88-20f7382dd24c",
89107
"IsCustom": false,
90-
"Description": "Lets you manage everything except access to resources.",
108+
"Description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
91109
"Actions": [
92110
"*"
93111
],
@@ -96,46 +114,62 @@ Contributor role as displayed in [Azure PowerShell](role-definitions-list.md#azu
96114
"Microsoft.Authorization/*/Write",
97115
"Microsoft.Authorization/elevateAccess/Action",
98116
"Microsoft.Blueprint/blueprintAssignments/write",
99-
"Microsoft.Blueprint/blueprintAssignments/delete"
117+
"Microsoft.Blueprint/blueprintAssignments/delete",
118+
"Microsoft.Compute/galleries/share/action",
119+
"Microsoft.Purview/consents/write",
120+
"Microsoft.Purview/consents/delete"
100121
],
101122
"DataActions": [],
102123
"NotDataActions": [],
103124
"AssignableScopes": [
104125
"/"
105-
]
126+
],
127+
"Condition": null,
128+
"ConditionVersion": null
106129
}
107130
```
108131

109132
Contributor role as displayed in [Azure CLI](role-definitions-list.md#azure-cli):
110133

111134
```json
112-
{
113-
"assignableScopes": [
114-
"/"
115-
],
116-
"description": "Lets you manage everything except access to resources.",
117-
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
118-
"name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
119-
"permissions": [
120-
{
121-
"actions": [
122-
"*"
123-
],
124-
"notActions": [
125-
"Microsoft.Authorization/*/Delete",
126-
"Microsoft.Authorization/*/Write",
127-
"Microsoft.Authorization/elevateAccess/Action",
128-
"Microsoft.Blueprint/blueprintAssignments/write",
129-
"Microsoft.Blueprint/blueprintAssignments/delete"
130-
],
131-
"dataActions": [],
132-
"notDataActions": []
133-
}
134-
],
135-
"roleName": "Contributor",
136-
"roleType": "BuiltInRole",
137-
"type": "Microsoft.Authorization/roleDefinitions"
138-
}
135+
[
136+
{
137+
"assignableScopes": [
138+
"/"
139+
],
140+
"createdBy": null,
141+
"createdOn": "2015-02-02T21:55:09.880642+00:00",
142+
"description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
143+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
144+
"name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
145+
"permissions": [
146+
{
147+
"actions": [
148+
"*"
149+
],
150+
"condition": null,
151+
"conditionVersion": null,
152+
"dataActions": [],
153+
"notActions": [
154+
"Microsoft.Authorization/*/Delete",
155+
"Microsoft.Authorization/*/Write",
156+
"Microsoft.Authorization/elevateAccess/Action",
157+
"Microsoft.Blueprint/blueprintAssignments/write",
158+
"Microsoft.Blueprint/blueprintAssignments/delete",
159+
"Microsoft.Compute/galleries/share/action",
160+
"Microsoft.Purview/consents/write",
161+
"Microsoft.Purview/consents/delete"
162+
],
163+
"notDataActions": []
164+
}
165+
],
166+
"roleName": "Contributor",
167+
"roleType": "BuiltInRole",
168+
"type": "Microsoft.Authorization/roleDefinitions",
169+
"updatedBy": null,
170+
"updatedOn": "2023-07-10T15:10:53.947865+00:00"
171+
}
172+
]
139173
```
140174

141175
## Control and data actions
@@ -177,37 +211,47 @@ Storage Blob Data Reader role as displayed in Azure PowerShell:
177211
"NotDataActions": [],
178212
"AssignableScopes": [
179213
"/"
180-
]
214+
],
215+
"Condition": null,
216+
"ConditionVersion": null
181217
}
182218
```
183219

184220
Storage Blob Data Reader role as displayed in Azure CLI:
185221

186222
```json
187-
{
188-
"assignableScopes": [
189-
"/"
190-
],
191-
"description": "Allows for read access to Azure Storage blob containers and data",
192-
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
193-
"name": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
194-
"permissions": [
195-
{
196-
"actions": [
197-
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
198-
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
199-
],
200-
"notActions": [],
201-
"dataActions": [
202-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
203-
],
204-
"notDataActions": []
205-
}
206-
],
207-
"roleName": "Storage Blob Data Reader",
208-
"roleType": "BuiltInRole",
209-
"type": "Microsoft.Authorization/roleDefinitions"
210-
}
223+
[
224+
{
225+
"assignableScopes": [
226+
"/"
227+
],
228+
"createdBy": null,
229+
"createdOn": "2017-12-21T00:01:24.797231+00:00",
230+
"description": "Allows for read access to Azure Storage blob containers and data",
231+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
232+
"name": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
233+
"permissions": [
234+
{
235+
"actions": [
236+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
237+
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
238+
],
239+
"condition": null,
240+
"conditionVersion": null,
241+
"dataActions": [
242+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
243+
],
244+
"notActions": [],
245+
"notDataActions": []
246+
}
247+
],
248+
"roleName": "Storage Blob Data Reader",
249+
"roleType": "BuiltInRole",
250+
"type": "Microsoft.Authorization/roleDefinitions",
251+
"updatedBy": null,
252+
"updatedOn": "2021-11-11T20:13:55.297507+00:00"
253+
}
254+
]
211255
```
212256

213257
Only data plane actions can be added to the `DataActions` and `NotDataActions` properties. Resource providers identify which actions are data actions, by setting the `isDataAction` property to `true`. To see a list of the actions where `isDataAction` is `true`, see [Resource provider operations](resource-provider-operations.md). Roles that do not have data actions are not required to have `DataActions` and `NotDataActions` properties within the role definition.
@@ -237,8 +281,9 @@ Storage Blob Data Contributor
237281
&nbsp;&nbsp;&nbsp;&nbsp;DataActions<br>
238282
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`<br>
239283
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`<br>
284+
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`<br>
240285
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action`<br>
241-
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
286+
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action`
242287

243288
Since Alice has a wildcard (`*`) action at a subscription scope, their permissions inherit down to enable them to perform all control plane actions. Alice can read, write, and delete containers. However, Alice cannot perform data plane actions without taking additional steps. For example, by default, Alice cannot read the blobs inside a container. To read the blobs, Alice would have to retrieve the storage access keys and use them to access the blobs.
244289

@@ -353,7 +398,7 @@ Examples of valid assignable scopes include:
353398
354399
You can define only one management group in `AssignableScopes` of a custom role.
355400

356-
Although it's possible to create a custom role with a resource instance in `AssignableScopes` using the command line, it's not recommended. Each tenant supports a maximum of 5000 custom roles. Using this strategy could potentially exhaust your available custom roles. Ultimately, the level of access is determined by the custom role assignment (scope + role permissions + security principal) and not the `AssignableScopes` listed in the custom role. So, create your custom roles with `AssignableScopes` of management group, subscription, or resource group, but assign the custom roles with narrow scope, such as resource or resource group.
401+
Although it's possible to create a custom role with a resource instance in `AssignableScopes` using the command line, it's not recommended. Each tenant supports a maximum of 5,000 custom roles. Using this strategy could potentially exhaust your available custom roles. Ultimately, the level of access is determined by the custom role assignment (scope + role permissions + security principal) and not the `AssignableScopes` listed in the custom role. So, create your custom roles with `AssignableScopes` of management group, subscription, or resource group, but assign the custom roles with narrow scope, such as resource or resource group.
357402

358403
For more information about `AssignableScopes` for custom roles, see [Azure custom roles](custom-roles.md).
359404

0 commit comments

Comments
 (0)