Skip to content

Commit d7299a2

Browse files
authored
Merge pull request #123199 from azarboon/patch-106
Update custom-roles.md
2 parents 7b1307d + 6a4bbac commit d7299a2

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

articles/role-based-access-control/custom-roles.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,9 @@ Just like built-in roles, the `AssignableScopes` property specifies the scopes t
184184
| Update a custom role | `Microsoft.Authorization/ roleDefinitions/write` | Users that are granted this action on all the `AssignableScopes` of the custom role can update custom roles in those scopes. For example, [Owners](built-in-roles.md#owner) and [User Access Administrators](built-in-roles.md#user-access-administrator) of management groups, subscriptions, and resource groups. |
185185
| View a custom role | `Microsoft.Authorization/ roleDefinitions/read` | Users that are granted this action at a scope can view the custom roles that are available for assignment at that scope. All built-in roles allow custom roles to be available for assignment. |
186186

187+
> [!NOTE]
188+
> Even if a role is renamed, the role ID does not change. If you are using scripts or automation to create your role assignments, it's a best practice to use the unique role ID instead of the role name. Therefore, if a role is renamed, your scripts are more likely to work.
189+
187190
## Find role assignments to delete a custom role
188191

189192
Before you can delete a custom role, you must remove any role assignments that use the custom role. If you try to delete a custom role with role assignments, you get the message: `There are existing role assignments referencing role (code: RoleDefinitionHasAssignments)`.

0 commit comments

Comments
 (0)