Skip to content

Commit fbe36da

Browse files
rolyonrolyon
committed
Role definition properties
1 parent 08acf81 commit fbe36da

File tree

1 file changed

+111
-66
lines changed

1 file changed

+111
-66
lines changed

‎articles/role-based-access-control/role-definitions.md

Lines changed: 111 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: rolyon
66
manager: amycolannino
77
ms.service: role-based-access-control
88
ms.topic: conceptual
9-
ms.date: 11/06/2023
9+
ms.date: 02/12/2024
1010
ms.author: rolyon
1111
ms.custom:
1212
---
@@ -30,35 +30,53 @@ NotActions []
3030
DataActions []
3131
NotDataActions []
3232
AssignableScopes []
33+
Condition
34+
ConditionVersion
3335
```
3436

3537
The following shows an example of the properties in a role definition when displayed using the [Azure portal](role-definitions-list.md#azure-portal), [Azure CLI](role-definitions-list.md#azure-cli), or the [REST API](role-definitions-list.md#rest-api):
3638

3739
```
3840
roleName
3941
name
42+
id
43+
roleType
4044
type
4145
description
46+
assignableScopes []
4247
actions []
4348
notActions []
4449
dataActions []
4550
notDataActions []
46-
assignableScopes []
51+
condition
52+
conditionVersion
53+
createdOn
54+
updatedOn
55+
createdBy
56+
updatedBy
4757
```
4858

4959
The following table describes what the role properties mean.
5060

5161
| Property | Description |
5262
| --- | --- |
53-
| `Name`</br>`roleName` | The display name of the role. |
54-
| `Id`</br>`name` | The unique ID of the role. Built-in roles have the same role ID across clouds. |
63+
| `Name`</br>`roleName` | Display name of the role. |
64+
| `Id`</br>`name` | Unique ID of the role. Built-in roles have the same role ID across clouds. |
65+
| `id` | Fully-qualified unique ID of the role. |
5566
| `IsCustom`</br>`roleType` | Indicates whether this is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
56-
| `Description`</br>`description` | The description of the role. |
57-
| `Actions`</br>`actions` | An array of strings that specifies the control plane actions that the role allows to be performed. |
58-
| `NotActions`</br>`notActions` | An array of strings that specifies the control plane actions that are excluded from the allowed `Actions`. |
59-
| `DataActions`</br>`dataActions` | An array of strings that specifies the data plane actions that the role allows to be performed to your data within that object. |
60-
| `NotDataActions`</br>`notDataActions` | An array of strings that specifies the data plane actions that are excluded from the allowed `DataActions`. |
61-
| `AssignableScopes`</br>`assignableScopes` | An array of strings that specifies the scopes that the role is available for assignment. |
67+
| `type` | Type of object. Set to `Microsoft.Authorization/roleDefinitions`. |
68+
| `Description`</br>`description` | Description of the role. |
69+
| `Actions`</br>`actions` | Array of strings that specifies the control plane actions that the role allows to be performed. |
70+
| `NotActions`</br>`notActions` | Array of strings that specifies the control plane actions that are excluded from the allowed `Actions`. |
71+
| `DataActions`</br>`dataActions` | Array of strings that specifies the data plane actions that the role allows to be performed to your data within that object. |
72+
| `NotDataActions`</br>`notDataActions` | Array of strings that specifies the data plane actions that are excluded from the allowed `DataActions`. |
73+
| `AssignableScopes`</br>`assignableScopes` | Array of strings that specifies the scopes that the role is available for assignment. |
74+
| `Condition`<br/>`condition` | For built-in roles, condition statement based on one or more actions in role definition. |
75+
| `ConditionVersion`<br/>`conditionVersion` | Condition version number. Defaults to 2.0 and is the only supported version. |
76+
| `createdOn` | Date and time role was created. |
77+
| `updatedOn` | Date and time role was last updated. |
78+
| `createdBy` | For custom roles, principal that created role. |
79+
| `updatedBy` | For custom roles, principal that updated role. |
6280

6381
### Actions format
6482

@@ -87,7 +105,7 @@ Contributor role as displayed in [Azure PowerShell](role-definitions-list.md#azu
87105
"Name": "Contributor",
88106
"Id": "b24988ac-6180-42a0-ab88-20f7382dd24c",
89107
"IsCustom": false,
90-
"Description": "Lets you manage everything except access to resources.",
108+
"Description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
91109
"Actions": [
92110
"*"
93111
],
@@ -96,46 +114,62 @@ Contributor role as displayed in [Azure PowerShell](role-definitions-list.md#azu
96114
"Microsoft.Authorization/*/Write",
97115
"Microsoft.Authorization/elevateAccess/Action",
98116
"Microsoft.Blueprint/blueprintAssignments/write",
99-
"Microsoft.Blueprint/blueprintAssignments/delete"
117+
"Microsoft.Blueprint/blueprintAssignments/delete",
118+
"Microsoft.Compute/galleries/share/action",
119+
"Microsoft.Purview/consents/write",
120+
"Microsoft.Purview/consents/delete"
100121
],
101122
"DataActions": [],
102123
"NotDataActions": [],
103124
"AssignableScopes": [
104125
"/"
105-
]
126+
],
127+
"Condition": null,
128+
"ConditionVersion": null
106129
}
107130
```
108131

109132
Contributor role as displayed in [Azure CLI](role-definitions-list.md#azure-cli):
110133

111134
```json
112-
{
113-
"assignableScopes": [
114-
"/"
115-
],
116-
"description": "Lets you manage everything except access to resources.",
117-
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
118-
"name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
119-
"permissions": [
120-
{
121-
"actions": [
122-
"*"
123-
],
124-
"notActions": [
125-
"Microsoft.Authorization/*/Delete",
126-
"Microsoft.Authorization/*/Write",
127-
"Microsoft.Authorization/elevateAccess/Action",
128-
"Microsoft.Blueprint/blueprintAssignments/write",
129-
"Microsoft.Blueprint/blueprintAssignments/delete"
130-
],
131-
"dataActions": [],
132-
"notDataActions": []
133-
}
134-
],
135-
"roleName": "Contributor",
136-
"roleType": "BuiltInRole",
137-
"type": "Microsoft.Authorization/roleDefinitions"
138-
}
135+
[
136+
{
137+
"assignableScopes": [
138+
"/"
139+
],
140+
"createdBy": null,
141+
"createdOn": "2015-02-02T21:55:09.880642+00:00",
142+
"description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
143+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
144+
"name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
145+
"permissions": [
146+
{
147+
"actions": [
148+
"*"
149+
],
150+
"condition": null,
151+
"conditionVersion": null,
152+
"dataActions": [],
153+
"notActions": [
154+
"Microsoft.Authorization/*/Delete",
155+
"Microsoft.Authorization/*/Write",
156+
"Microsoft.Authorization/elevateAccess/Action",
157+
"Microsoft.Blueprint/blueprintAssignments/write",
158+
"Microsoft.Blueprint/blueprintAssignments/delete",
159+
"Microsoft.Compute/galleries/share/action",
160+
"Microsoft.Purview/consents/write",
161+
"Microsoft.Purview/consents/delete"
162+
],
163+
"notDataActions": []
164+
}
165+
],
166+
"roleName": "Contributor",
167+
"roleType": "BuiltInRole",
168+
"type": "Microsoft.Authorization/roleDefinitions",
169+
"updatedBy": null,
170+
"updatedOn": "2023-07-10T15:10:53.947865+00:00"
171+
}
172+
]
139173
```
140174

141175
## Control and data actions
@@ -177,37 +211,47 @@ Storage Blob Data Reader role as displayed in Azure PowerShell:
177211
"NotDataActions": [],
178212
"AssignableScopes": [
179213
"/"
180-
]
214+
],
215+
"Condition": null,
216+
"ConditionVersion": null
181217
}
182218
```
183219

184220
Storage Blob Data Reader role as displayed in Azure CLI:
185221

186222
```json
187-
{
188-
"assignableScopes": [
189-
"/"
190-
],
191-
"description": "Allows for read access to Azure Storage blob containers and data",
192-
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
193-
"name": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
194-
"permissions": [
195-
{
196-
"actions": [
197-
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
198-
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
199-
],
200-
"notActions": [],
201-
"dataActions": [
202-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
203-
],
204-
"notDataActions": []
205-
}
206-
],
207-
"roleName": "Storage Blob Data Reader",
208-
"roleType": "BuiltInRole",
209-
"type": "Microsoft.Authorization/roleDefinitions"
210-
}
223+
[
224+
{
225+
"assignableScopes": [
226+
"/"
227+
],
228+
"createdBy": null,
229+
"createdOn": "2017-12-21T00:01:24.797231+00:00",
230+
"description": "Allows for read access to Azure Storage blob containers and data",
231+
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
232+
"name": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
233+
"permissions": [
234+
{
235+
"actions": [
236+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
237+
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
238+
],
239+
"condition": null,
240+
"conditionVersion": null,
241+
"dataActions": [
242+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
243+
],
244+
"notActions": [],
245+
"notDataActions": []
246+
}
247+
],
248+
"roleName": "Storage Blob Data Reader",
249+
"roleType": "BuiltInRole",
250+
"type": "Microsoft.Authorization/roleDefinitions",
251+
"updatedBy": null,
252+
"updatedOn": "2021-11-11T20:13:55.297507+00:00"
253+
}
254+
]
211255
```
212256

213257
Only data plane actions can be added to the `DataActions` and `NotDataActions` properties. Resource providers identify which actions are data actions, by setting the `isDataAction` property to `true`. To see a list of the actions where `isDataAction` is `true`, see [Resource provider operations](resource-provider-operations.md). Roles that do not have data actions are not required to have `DataActions` and `NotDataActions` properties within the role definition.
@@ -237,8 +281,9 @@ Storage Blob Data Contributor
237281
&nbsp;&nbsp;&nbsp;&nbsp;DataActions<br>
238282
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`<br>
239283
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`<br>
284+
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`<br>
240285
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action`<br>
241-
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
286+
&nbsp;&nbsp;&nbsp;&nbsp;`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action`
242287

243288
Since Alice has a wildcard (`*`) action at a subscription scope, their permissions inherit down to enable them to perform all control plane actions. Alice can read, write, and delete containers. However, Alice cannot perform data plane actions without taking additional steps. For example, by default, Alice cannot read the blobs inside a container. To read the blobs, Alice would have to retrieve the storage access keys and use them to access the blobs.
244289

0 commit comments

Comments
 (0)