diff --git a/data-explorer/kusto/access-control/role-based-access-control.md b/data-explorer/kusto/access-control/role-based-access-control.md index cd112d49b5..1769b06f0e 100644 --- a/data-explorer/kusto/access-control/role-based-access-control.md +++ b/data-explorer/kusto/access-control/role-based-access-control.md @@ -80,19 +80,19 @@ The **Manage** column offers ways to add or remove role principals. | Scope | Role | Permissions | How the role is obtained | | ---- | ---- | ----------- | ------------------------- | -| Eventhouse | AllDatabasesAdmin | Full permission to all databases in the Eventhouse. May show and alter certain Eventhouse-level policies. Includes all permissions. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**.

Can't be assigned with management commands. | -| Database | Admin | Full permission in the scope of a particular database. Includes all lower level permissions. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- [Item shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md) | -| Database | User | Read all data and metadata of the database. Create tables and functions, and become the admin for those tables and functions. | - Assigned with [management commands](../management/manage-database-security-roles.md) | -| Database | Viewer | Read all data and metadata, except for tables with the [RestrictedViewAccess policy](../management/show-table-restricted-view-access-policy-command.md) turned on. | - [Item shared](/fabric/get-started/share-items#item-permission-model) with viewing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md) | -| Database | Unrestrictedviewer | Read all data and metadata, including in tables with the [RestrictedViewAccess policy](../management/show-table-restricted-view-access-policy-command.md) turned on. | - Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Database Viewer**. | -| Database | Ingestor | Ingest data to all tables in the database without access to query the data. | - Assigned with [management commands](../management/manage-database-security-roles.md) | -| Database | Monitor | Execute `.show` commands in the context of the database and its child entities. | - Assigned with [management commands](../management/manage-database-security-roles.md) | -| Table | Admin | Full permission in the scope of a particular table. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** on the parent database. | -| Table | Ingestor | Ingest data to the table without access to query the data. | - Assigned with [management commands](../management/manage-table-security-roles.md). Dependent on having **Database User** or **Database Ingestor** on the parent database. | -| External Table | Admin | Full permission in the scope of a particular external table. | - Assigned with [management commands](../management/manage-external-table-security-roles.md). Dependent on having **Database User** or **Database Viewer** on the parent database. | -| Materialized view | Admin | Full permission to alter the view, delete the view, and grant admin permissions to another principal. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Table Admin** on the parent items. | -| Function | Admin | Full permission to alter the function, delete the function, and grant admin permissions to another principal. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Table Admin** on the parent items. | -| Graph | GraphAdmin | Full permission in the scope of a particular graph model. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Table Admin** on the parent items. | | +| Eventhouse | AllDatabasesAdmin | Full permission to all databases in the Eventhouse. May show and alter certain Eventhouse-level policies. Includes all permissions. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**.

Can't be assigned with management commands. | +| Database | Admin | Full permission in the scope of a particular database. Includes all lower level permissions. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- [Item shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md) | +| Database | User | Read all data and metadata of the database. Create tables and functions, and become the admin for those tables and functions. | - Assigned with [management commands](../management/manage-database-security-roles.md) | +| Database | Viewer | Read all data and metadata, except for tables with the [RestrictedViewAccess policy](../management/show-table-restricted-view-access-policy-command.md) turned on. | - [Item shared](/fabric/get-started/share-items#item-permission-model) with viewing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md) | +| Database | Unrestrictedviewer | Read all data and metadata, including in tables with the [RestrictedViewAccess policy](../management/show-table-restricted-view-access-policy-command.md) turned on. | - Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Database Viewer**. | +| Database | Ingestor | Ingest data to all tables in the database without access to query the data. | - Assigned with [management commands](../management/manage-database-security-roles.md) | +| Database | Monitor | Execute `.show` commands in the context of the database and its child entities. | - Assigned with [management commands](../management/manage-database-security-roles.md) | +| Table | Admin | Full permission in the scope of a particular table. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** on the parent database. | +| Table | Ingestor | Ingest data to the table without access to query the data. | - Assigned with [management commands](../management/manage-table-security-roles.md). Dependent on having **Database User** or **Database Ingestor** on the parent database. | +| External Table | Admin | Full permission in the scope of a particular external table. | - Assigned with [management commands](../management/manage-external-table-security-roles.md). Dependent on having **Database User** or **Database Viewer** on the parent database. | +| Materialized view | Admin | Full permission to alter the view, delete the view, and grant admin permissions to another principal. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Table Admin** on the parent items. | +| Function | Admin | Full permission to alter the function, delete the function, and grant admin permissions to another principal. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Table Admin** on the parent items. | +| Graph | GraphAdmin | Full permission in the scope of a particular graph model. | - Inherited as workspace **admin**, workspace **member**, or workspace **contributor**
- Parent item (KQL Database) [shared](/fabric/get-started/share-items#item-permission-model) with editing permissions.
- Assigned with [management commands](../management/manage-database-security-roles.md). Dependent on having **Database User** or **Table Admin** on the parent items. | ::: moniker-end ## Related content