|
| 1 | +## Assign roles to the managed identity |
| 2 | + |
| 3 | +Next, determine which roles your app needs and assign those roles to the managed identity. You can assign roles to a managed identity at the following scopes: |
| 4 | + |
| 5 | +- **Resource**: The assigned roles only apply to that specific resource. |
| 6 | +- **Resource group**: The assigned roles apply to all resources contained in the resource group. |
| 7 | +- **Subscription**: The assigned roles apply to all resources contained in the subscription. |
| 8 | + |
| 9 | +The following example shows how to assign roles at the resource group scope, since many apps manage all their related Azure resources using a single resource group. |
| 10 | + |
| 11 | +### [Azure portal](#tab/azure-portal) |
| 12 | + |
| 13 | +1. Navigate to the **Overview** page of the resource group that contains the app with the system-assigned managed identity. |
| 14 | +1. Select **Access control (IAM)** on the left navigation. |
| 15 | +1. On the **Access control (IAM)** page, select **+ Add** on the top menu and then choose **Add role assignment** to navigate to the **Add role assignment** page. |
| 16 | + |
| 17 | + :::image type="content" source="../media/system-assigned-identity-access-control.png" alt-text="A screenshot showing how to access the identity role assignment page."::: |
| 18 | + |
| 19 | +1. The **Add role assignment** page presents a tabbed, multi-step workflow to assign roles to identities. On the initial **Role** tab, use the search box at the top to locate the role you want to assign to the identity. |
| 20 | +1. Select the role from the results and then choose **Next** to move to the **Members** tab. |
| 21 | +1. For the **Assign access to** option, select **Managed identity**. |
| 22 | +1. For the **Members** option, choose **+ Select members** to open the **Select managed identities** panel. |
| 23 | +1. On the **Select managed identities** panel, use the **Subscription** and **Managed identity** dropdowns to filter the search results for your identities. Use the **Select** search box to locate the system-identity you enabled for the Azure resource hosting your app. |
| 24 | + |
| 25 | + :::image type="content" source="../media/system-assigned-identity-assign-roles.png" alt-text="A screenshot showing the managed identity assignment process."::: |
| 26 | + |
| 27 | +1. Select the identity and choose **Select** at the bottom of the panel to continue. |
| 28 | +1. Select **Review + assign** at the bottom of the page. |
| 29 | +1. On the final **Review + assign** tab, select **Review + assign** to complete the workflow. |
| 30 | + |
| 31 | +### [Azure CLI](#tab/azure-cli) |
| 32 | + |
| 33 | +A managed identity is assigned a role in Azure using the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command: |
| 34 | + |
| 35 | +```azurecli |
| 36 | +az role assignment create \ |
| 37 | + --assignee "{principalId}" \ |
| 38 | + --role "{roleName}" \ |
| 39 | + --scope "{scope}" |
| 40 | +``` |
| 41 | + |
| 42 | +To get the role names to which a service principal can be assigned, use the [az role definition list](/cli/azure/role/definition#az-role-definition-list) command: |
| 43 | + |
| 44 | +```azurecli |
| 45 | +az role definition list \ |
| 46 | + --query "sort_by([].{roleName:roleName, description:description}, &roleName)" \ |
| 47 | + --output table |
| 48 | +``` |
| 49 | + |
| 50 | +For example, to allow the managed identity with the ID of `99999999-9999-9999-9999-999999999999` read, write, and delete access to Azure Storage blob containers and data to all storage accounts in the *msdocs-dotnet-sdk-auth-example* resource group, assign the application service principal to the *Storage Blob Data Contributor* role using the following command: |
| 51 | + |
| 52 | +```azurecli |
| 53 | +az role assignment create \ |
| 54 | + --assignee 99999999-9999-9999-9999-999999999999 \ |
| 55 | + --role "Storage Blob Data Contributor" \ |
| 56 | + --scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/msdocs-dotnet-sdk-auth-example" |
| 57 | +``` |
| 58 | + |
| 59 | +For information on assigning permissions at the resource or subscription level using the Azure CLI, see the article [Assign Azure roles using the Azure CLI](/azure/role-based-access-control/role-assignments-cli). |
| 60 | + |
| 61 | +--- |
0 commit comments