Skip to content

Commit e78f248

Browse files
rolyonrolyon
committed
Updated property tables
1 parent bad0fd1 commit e78f248

File tree

2 files changed

+106
-28
lines changed

2 files changed

+106
-28
lines changed

‎articles/role-based-access-control/custom-roles.md

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.devlang: na
1212
ms.topic: conceptual
1313
ms.tgt_pltfrm: na
1414
ms.workload: identity
15-
ms.date: 05/07/2020
15+
ms.date: 05/08/2020
1616
ms.author: rolyon
1717
ms.reviewer: bagovind
1818
ms.custom: H1Hack27Feb2017
@@ -113,15 +113,15 @@ The following table describes what the custom role properties mean.
113113

114114
| Property | Required | Type | Description |
115115
| --- | --- | --- | --- |
116-
| `Name` | Yes | String | The display name of the custom role. While a role definition is a management group or subscription-level resource, a role definition can be used in multiple subscriptions that share the same Azure AD directory. This display name must be unique at the scope of the Azure AD directory. Can include letters, numbers, spaces, and special characters. Maximum number of characters is 128. |
117-
| `Id` | Yes | String | The unique ID of the custom role. For Azure PowerShell and Azure CLI, this ID is automatically generated when you create a new role. |
118-
| `IsCustom` | Yes | String | Indicates whether this is a custom role. Set to `true` for custom roles. |
119-
| `Description` | Yes | String | The description of the custom role. Can include letters, numbers, spaces, and special characters. Maximum number of characters is 1024. |
120-
| `Actions` | Yes | String[] | An array of strings that specifies the management operations that the role allows to be performed. For more information, see [Actions](role-definitions.md#actions). |
121-
| `NotActions` | No | String[] | An array of strings that specifies the management operations that are excluded from the allowed `Actions`. For more information, see [NotActions](role-definitions.md#notactions). |
122-
| `DataActions` | No | String[] | An array of strings that specifies the data operations that the role allows to be performed to your data within that object. If you create a custom role with `DataActions`, that role cannot be assigned at the management group scope. For more information, see [DataActions](role-definitions.md#dataactions). |
123-
| `NotDataActions` | No | String[] | An array of strings that specifies the data operations that are excluded from the allowed `DataActions`. For more information, see [NotDataActions](role-definitions.md#notdataactions). |
124-
| `AssignableScopes` | Yes | String[] | An array of strings that specifies the scopes that the custom role is available for assignment. You can only define one management group in `AssignableScopes` of a custom role. Adding a management group to `AssignableScopes` is currently in preview. For more information, see [AssignableScopes](role-definitions.md#assignablescopes). |
116+
| `Name`</br>`roleName` | Yes | String | The display name of the custom role. While a role definition is a management group or subscription-level resource, a role definition can be used in multiple subscriptions that share the same Azure AD directory. This display name must be unique at the scope of the Azure AD directory. Can include letters, numbers, spaces, and special characters. Maximum number of characters is 128. |
117+
| `Id`</br>`name` | Yes | String | The unique ID of the custom role. For Azure PowerShell and Azure CLI, this ID is automatically generated when you create a new role. |
118+
| `IsCustom`</br>`roleType` | Yes | String | Indicates whether this is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
119+
| `Description`</br>`description` | Yes | String | The description of the custom role. Can include letters, numbers, spaces, and special characters. Maximum number of characters is 1024. |
120+
| `Actions`</br>`actions` | Yes | String[] | An array of strings that specifies the management operations that the role allows to be performed. For more information, see [Actions](role-definitions.md#actions). |
121+
| `NotActions`</br>`notActions` | No | String[] | An array of strings that specifies the management operations that are excluded from the allowed `Actions`. For more information, see [NotActions](role-definitions.md#notactions). |
122+
| `DataActions`</br>`dataActions` | No | String[] | An array of strings that specifies the data operations that the role allows to be performed to your data within that object. If you create a custom role with `DataActions`, that role cannot be assigned at the management group scope. For more information, see [DataActions](role-definitions.md#dataactions). |
123+
| `NotDataActions`</br>`notDataActions` | No | String[] | An array of strings that specifies the data operations that are excluded from the allowed `DataActions`. For more information, see [NotDataActions](role-definitions.md#notdataactions). |
124+
| `AssignableScopes`</br>`assignableScopes` | Yes | String[] | An array of strings that specifies the scopes that the custom role is available for assignment. You can only define one management group in `AssignableScopes` of a custom role. Adding a management group to `AssignableScopes` is currently in preview. For more information, see [AssignableScopes](role-definitions.md#assignablescopes). |
125125

126126
## Steps to create a custom role
127127

@@ -201,7 +201,7 @@ To update a custom role using Azure PowerShell, you must provide the following i
201201
}
202202
```
203203

204-
The following shows an example of the output when listing a custom role using Azure PowerShell and the [ConvertTo-Json](/powershell/module/microsoft.powershell.utility/convertto-json) command.
204+
The following shows an example of the output when you list a custom role using Azure PowerShell and the [ConvertTo-Json](/powershell/module/microsoft.powershell.utility/convertto-json) command.
205205

206206
```json
207207
{
@@ -233,7 +233,7 @@ To create or update a custom role using Azure CLI, you must provide following in
233233
}
234234
```
235235

236-
The following shows an example of the output when listing a custom role using Azure CLI.
236+
The following shows an example of the output when you list a custom role using Azure CLI.
237237

238238
```json
239239
[
@@ -279,7 +279,7 @@ To create or update a custom role using the REST API, you must provide following
279279
}
280280
```
281281

282-
The following shows an example of the output when listing a custom role using the REST API.
282+
The following shows an example of the output when you list a custom role using the REST API.
283283

284284
```json
285285
{
@@ -291,7 +291,9 @@ The following shows an example of the output when listing a custom role using th
291291
"permissions": [
292292
{
293293
"actions": [],
294-
"notActions": []
294+
"notActions": [],
295+
"dataActions": [],
296+
"notDataActions": []
295297
}
296298
],
297299
"createdOn": "",

‎articles/role-based-access-control/role-definitions.md

Lines changed: 90 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.devlang: na
1212
ms.topic: conceptual
1313
ms.tgt_pltfrm: na
1414
ms.workload: identity
15-
ms.date: 04/17/2020
15+
ms.date: 05/08/2020
1616
ms.author: rolyon
1717
ms.reviewer: bagovind
1818
ms.custom:
@@ -23,7 +23,9 @@ If you are trying to understand how an Azure role works or if you are creating y
2323

2424
## Role definition
2525

26-
A *role definition* is a collection of permissions. It's sometimes just called a *role*. A role definition lists the operations that can be performed, such as read, write, and delete. It can also list the operations that can't be performed or operations related to underlying data. A role definition has the following properties:
26+
A *role definition* is a collection of permissions. It's sometimes just called a *role*. A role definition lists the operations that can be performed, such as read, write, and delete. It can also list the operations that are excluded from allowed operations or operations related to underlying data.
27+
28+
The following shows an example of the properties in a role definition when displayed using Azure PowerShell:
2729

2830
```
2931
Name
@@ -37,17 +39,31 @@ NotDataActions []
3739
AssignableScopes []
3840
```
3941

42+
The following shows an example of the properties in a role definition when displayed using the Azure portal, Azure CLI, or the REST API:
43+
44+
```
45+
roleName
46+
name
47+
type
48+
description
49+
actions []
50+
notActions []
51+
dataActions []
52+
notDataActions []
53+
assignableScopes []
54+
```
55+
4056
| Property | Description |
4157
| --- | --- |
42-
| `Name` | The display name of the role. |
43-
| `Id` | The unique ID of the role. |
44-
| `IsCustom` | Indicates whether this is a custom role. Set to `true` for custom roles. |
45-
| `Description` | The description of the role. |
46-
| `Actions` | An array of strings that specifies the management operations that the role allows to be performed. |
47-
| `NotActions` | An array of strings that specifies the management operations that are excluded from the allowed `Actions`. |
48-
| `DataActions` | An array of strings that specifies the data operations that the role allows to be performed to your data within that object. |
49-
| `NotDataActions` | An array of strings that specifies the data operations that are excluded from the allowed `DataActions`. |
50-
| `AssignableScopes` | An array of strings that specifies the scopes that the role is available for assignment. |
58+
| `Name`</br>`roleName` | The display name of the role. |
59+
| `Id`</br>`name` | The unique ID of the role. |
60+
| `IsCustom`</br>`roleType` | Indicates whether this is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
61+
| `Description`</br>`description` | The description of the role. |
62+
| `Actions`</br>`actions` | An array of strings that specifies the management operations that the role allows to be performed. |
63+
| `NotActions`</br>`notActions` | An array of strings that specifies the management operations that are excluded from the allowed `Actions`. |
64+
| `DataActions`</br>`dataActions` | An array of strings that specifies the data operations that the role allows to be performed to your data within that object. |
65+
| `NotDataActions`</br>`notDataActions` | An array of strings that specifies the data operations that are excluded from the allowed `DataActions`. |
66+
| `AssignableScopes`</br>`assignableScopes` | An array of strings that specifies the scopes that the role is available for assignment. |
5167

5268
### Operations format
5369

@@ -67,7 +83,7 @@ The `{action}` portion of an operation string specifies the type of operations y
6783

6884
### Role definition example
6985

70-
Here's the [Contributor](built-in-roles.md#contributor) role definition in JSON format. The wildcard (`*`) operation under `Actions` indicates that the principal assigned to this role can perform all actions, or in other words, it can manage everything. This includes actions defined in the future, as Azure adds new resource types. The operations under `NotActions` are subtracted from `Actions`. In the case of the [Contributor](built-in-roles.md#contributor) role, `NotActions` removes this role's ability to manage access to resources and also assign access to resources.
86+
Here's the [Contributor](built-in-roles.md#contributor) role definition as displayed in Azure PowerShell and Azure CLI. The wildcard (`*`) operation under `Actions` indicates that the principal assigned to this role can perform all actions, or in other words, it can manage everything. This includes actions defined in the future, as Azure adds new resource types. The operations under `NotActions` are subtracted from `Actions`. In the case of the [Contributor](built-in-roles.md#contributor) role, `NotActions` removes this role's ability to manage access to resources and also assign access to resources.
7187

7288
```json
7389
{
@@ -81,7 +97,9 @@ Here's the [Contributor](built-in-roles.md#contributor) role definition in JSON
8197
"NotActions": [
8298
"Microsoft.Authorization/*/Delete",
8399
"Microsoft.Authorization/*/Write",
84-
"Microsoft.Authorization/elevateAccess/Action"
100+
"Microsoft.Authorization/elevateAccess/Action",
101+
"Microsoft.Blueprint/blueprintAssignments/write",
102+
"Microsoft.Blueprint/blueprintAssignments/delete"
85103
],
86104
"DataActions": [],
87105
"NotDataActions": [],
@@ -91,6 +109,36 @@ Here's the [Contributor](built-in-roles.md#contributor) role definition in JSON
91109
}
92110
```
93111

112+
```json
113+
{
114+
"assignableScopes": [
115+
"/"
116+
],
117+
"description": "Lets you manage everything except access to resources.",
118+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
119+
"name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
120+
"permissions": [
121+
{
122+
"actions": [
123+
"*"
124+
],
125+
"notActions": [
126+
"Microsoft.Authorization/*/Delete",
127+
"Microsoft.Authorization/*/Write",
128+
"Microsoft.Authorization/elevateAccess/Action",
129+
"Microsoft.Blueprint/blueprintAssignments/write",
130+
"Microsoft.Blueprint/blueprintAssignments/delete"
131+
],
132+
"dataActions": [],
133+
"notDataActions": []
134+
}
135+
],
136+
"roleName": "Contributor",
137+
"roleType": "BuiltInRole",
138+
"type": "Microsoft.Authorization/roleDefinitions"
139+
}
140+
```
141+
94142
## Management and data operations
95143

96144
Role-based access control for management operations is specified in the `Actions` and `NotActions` properties of a role definition. Here are some examples of management operations in Azure:
@@ -118,7 +166,8 @@ Here's the [Storage Blob Data Reader](built-in-roles.md#storage-blob-data-reader
118166
"IsCustom": false,
119167
"Description": "Allows for read access to Azure Storage blob containers and data",
120168
"Actions": [
121-
"Microsoft.Storage/storageAccounts/blobServices/containers/read"
169+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
170+
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
122171
],
123172
"NotActions": [],
124173
"DataActions": [
@@ -131,6 +180,33 @@ Here's the [Storage Blob Data Reader](built-in-roles.md#storage-blob-data-reader
131180
}
132181
```
133182

183+
```json
184+
{
185+
"assignableScopes": [
186+
"/"
187+
],
188+
"description": "Allows for read access to Azure Storage blob containers and data",
189+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
190+
"name": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
191+
"permissions": [
192+
{
193+
"actions": [
194+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
195+
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
196+
],
197+
"notActions": [],
198+
"dataActions": [
199+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
200+
],
201+
"notDataActions": []
202+
}
203+
],
204+
"roleName": "Storage Blob Data Reader",
205+
"roleType": "BuiltInRole",
206+
"type": "Microsoft.Authorization/roleDefinitions"
207+
}
208+
```
209+
134210
Only data operations can be added to the `DataActions` and `NotDataActions` properties. Resource providers identify which operations are data operations, by setting the `isDataAction` property to `true`. To see a list of the operations where `isDataAction` is `true`, see [Resource provider operations](resource-provider-operations.md). Roles that do not have data operations are not required to have `DataActions` and `NotDataActions` properties within the role definition.
135211

136212
Authorization for all management operation API calls is handled by Azure Resource Manager. Authorization for data operation API calls is handled by either a resource provider or Azure Resource Manager.

0 commit comments

Comments
 (0)