Merge pull request #193831 from dksimpson/1912257-RBAC-fix-12

Update RBAC role assignment steps - batch 12

Author: v-ccolin

articles/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints.md

@@ -6,7 +6,7 @@ ms.author: harshacs
 ms.service: site-recovery
 ms.topic: article
 ms.date: 07/14/2020
-ms.custom: references_regions
+ms.custom: references_regions, subject-rbac-steps
 ---
 # Replicate machines with private endpoints
 
@@ -220,22 +220,29 @@ following role permissions depending on the type of storage account:
   - [Classic Storage Account Contributor](../role-based-access-control/built-in-roles.md#classic-storage-account-contributor)
   - [Classic Storage Account Key Operator Service Role](../role-based-access-control/built-in-roles.md#classic-storage-account-key-operator-service-role)
 
-The following steps describe how to add a role-assignment to your storage accounts, one at a time:
+The following steps describe how to add a role assignment to your storage accounts, one at a time. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md).
 
-1. Go to the storage account and navigate to **Access control (IAM)** on the left side of the page.
+1. In the Azure portal, navigate to your Azure SQL Server page.
 
-1. Once on **Access control (IAM)**, in the "Add a role assignment" box select **Add**.
+1. Select **Access control (IAM)**.
 
-   :::image type="content" source="./media/azure-to-azure-how-to-enable-replication-private-endpoints/storage-role-assignment.png" alt-text="Shows the Access control (IAM) page on a storage account and the 'Add a role assignment' button in the Azure portal.":::
+1. Select **Add > Add role assignment**.
 
-1. In the "Add a role assignment" side page, choose the role from the list above in the **Role**
-   drop-down. Enter the **name** of the vault and select **Save**.
+   :::image type="content" source="../../includes/role-based-access-control/media/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
 
-   :::image type="content" source="./media/azure-to-azure-how-to-enable-replication-private-endpoints/storage-role-assignment-select-role.png" alt-text="Shows the Access control (IAM) page on a storage account and the options to select a Role and which principal to grant that role to in the Azure portal.":::
+1. On the **Roles** tab, select one of the roles listed in the beginning of this section.
 
-In addition to these permissions, MS trusted services need to be allowed access as well. Go to
-"Firewalls and virtual networks" and select "Allow trusted Microsoft services to access this storage
-account" checkbox in **Exceptions**.
+1. On the **Members** tab, select **Managed identity**, and then select **Select members**.
+
+1. Select **System-assigned managed identity**, search for a vault, and then select it.
+
+1. On the **Review + assign** tab, select **Review + assign** to assign the role.
+
+In addition to these permissions, you need to allow access to Microsoft trusted services. To do so, follow these steps:
+
+1. Go to **Firewalls and virtual networks**.
+
+1. In **Exceptions**, select **Allow trusted Microsoft services to access this storage account**.
 
 ## Protect your virtual machines
 

articles/site-recovery/hybrid-how-to-enable-replication-private-endpoints.md

@@ -6,6 +6,7 @@ ms.author: harshacs
 ms.service: site-recovery
 ms.topic: article
 ms.date: 07/14/2020
+ms.custom: subject-rbac-steps
 ---
 # Replicate on-premises machines by using private endpoints
 
@@ -208,22 +209,29 @@ following role permissions, depending on the type of storage account.
   - [Classic Storage Account Contributor](../role-based-access-control/built-in-roles.md#classic-storage-account-contributor)
   - [Classic Storage Account Key Operator Service Role](../role-based-access-control/built-in-roles.md#classic-storage-account-key-operator-service-role)
 
-These steps describe how to add a role assignment to your storage account:
+The following steps describe how to add a role assignment to your storage account. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md).
 
-1. Go to the storage account. Select **Access control (IAM)** in the left pane.
+1. Go to the storage account.
 
-1. In the **Add a role assignment** section, select **Add**:
+1. Select **Access control (IAM)**.
 
-   :::image type="content" source="./media/hybrid-how-to-enable-replication-private-endpoints/storage-role-assignment.png" alt-text="Screenshot that shows the Access control (IAM) page for a storage account.":::
+1. Select **Add > Add role assignment**.
 
-1. On the **Add a role assignment** page, in the **Role**
-   list, select the role from the list at the start of this section. Enter the name of the vault and then select **Save**.
+   :::image type="content" source="../../includes/role-based-access-control/media/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
 
-   :::image type="content" source="./media/hybrid-how-to-enable-replication-private-endpoints/storage-role-assignment-select-role.png" alt-text="Screenshot that shows the Add role assignment page.":::
+1. On the **Roles** tab, select one of the roles listed in the beginning of this section.
 
-After you add these permissions, you need to allow access to Microsoft trusted services. Go to
-**Firewalls and virtual networks** and select **Allow trusted Microsoft services to access this storage
-account** in **Exceptions**.
+1. On the **Members** tab, select **Managed identity**, and then select **Select members**.
+
+1. Select **System-assigned managed identity**, search for a vault, and then select it.
+
+1. On the **Review + assign** tab, select **Review + assign** to assign the role.
+
+In addition to these permissions, you need to allow access to Microsoft trusted services. To do so, follow these steps:
+
+1. Go to **Firewalls and virtual networks**.
+
+1. In **Exceptions**, select **Allow trusted Microsoft services to access this storage account**.
 
 ### Protect your virtual machines
 

articles/site-recovery/media/azure-to-azure-how-to-enable-replication-private-endpoints/storage-role-assignment-select-role.png

@@ -7,6 +7,7 @@ ms.service: site-recovery
 ms.topic: conceptual
 ms.date: 11/27/2018
 ms.author: mayg
+ms.custom: subject-rbac-steps
 ---
 
 # Set up VMware disaster recovery in a multi-tenancy environment with the Cloud Solution Provider (CSP) program
@@ -61,24 +62,38 @@ You can now perform and manage all Site Recovery operations for the tenant in th
 
 1. Ensure that the disaster recovery infrastructure is set up. Partners access tenant subscriptions through the CSP portal, regardless of whether disaster recovery is managed or self-service. Set up the vault and register infrastructure to the tenant subscriptions.
 1. Provide the tenant with the [account you created](#create-a-tenant-account).
-1. You can add a new user to the tenant subscription through the CSP portal as follows:
 
-    1. Go to the tenant’s CSP subscription page, and then select the **Users and licenses** option.
+You can add a new user to the tenant subscription through the CSP portal as follows:
 
-       ![The tenant's CSP subscription page](./media/vmware-azure-multi-tenant-csp-disaster-recovery/users-and-licences.png)
+1. Go to the tenant’s CSP subscription page, and then select the **Users and licenses** option.
 
-	1. Now create a new user by entering the relevant details and selecting permissions, or by uploading the list of users in a CSV file.
+    ![The tenant's CSP subscription page](./media/vmware-azure-multi-tenant-csp-disaster-recovery/users-and-licences.png)
 
-    1. After you've created a new user, go back to the Azure portal. In the **Subscription** page, select the relevant subscription.
+1. Create a new user by entering the relevant details and selecting permissions, or by uploading the list of users in a CSV file.
 
-    1. Select **Access control (IAM)**, and then click **Role assignments**.
+1. After you've created a new user, go back to the Azure portal. 
 
-    1. Click **Add role assignment** to add a user with the relevant access level. The users that were created through the CSP portal are displayed on the Role assignments tab.
+The following steps describe how to assign a role to a user. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md).
 
-        ![Add a user](./media/vmware-azure-multi-tenant-csp-disaster-recovery/add-user-subscription.png)
+1. In the **Subscription** page, select the relevant subscription.
 
-- For most management operations, the *Contributor* role is sufficient. Users with this access level can do everything on a subscription except change access levels (for which *Owner*-level access is required).
-- Site Recovery also has three [predefined user roles](site-recovery-role-based-linked-access-control.md), that can be used to further restrict access levels as required.
+1. In the navigation menu, select **Access control (IAM)**.
+
+1. Select **Add** > **Add role assignment**.
+
+   :::image type="content" source="../../includes/role-based-access-control/media/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
+
+1. On the **Role** tab, select a role.
+
+    For most management operations, the *Contributor* role is sufficient. Users with this access level can do everything on a subscription except change access levels (for which *Owner*-level access is required).
+
+    Site Recovery also has three [predefined user roles](site-recovery-role-based-linked-access-control.md), that can be used to further restrict access levels as required.
+
+    :::image type="content" source="../../includes/role-based-access-control/media/add-role-assignment-role-generic.png" alt-text="Screenshot that shows Add role assignment page with the Role tab selected.":::
+
+1. On the **Members** tab, select **User, group, or service principal**, and then select a user with the relevant access level. The users that were created through the CSP portal are displayed here.
+
+1. On the **Review + assign** tab, select **Review + assign** to assign the role.
 
 ## Multi-tenant environments