...
| Table of Contents |
|---|
Create a Custom Role
Keep in mind that you You need to have Owner or User Access Administrator permissions to create custom roles.
...
1. In the Azure portal, open a subscription or a resource group where the a custom role is to be assigned to.
...
c) 'Clone a role'. Select one* of the existing roles and open .
*Commonly used Azure built-in roles:
Built-in Role | ID |
|---|---|
Reader |
|
Contributor |
|
Virtual Machine Contributor |
|
Virtual Network Contributor |
|
Storage Account Contributor |
|
Web Plan Contributor |
|
SQL server Contributor |
|
SQL DB Contributor |
|
Open the tab 'JSON' to and modify the permissions . The JSON body should look like as in the template below:
| Code Block |
|---|
{
"name": "{your-existing-Role-definition-id}",
"permissions": [
{
"actions": [
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Storage/storageAccounts/listKeys/action"
],
"notActions": []
}
],
"AssignableScopes": [
"/subscriptions/{subscription-id}",
"/subscriptions/{subscription-id}",
"/subscriptions/{subscription-id}"
],
"RoleName": "{your-Role-name}",
"RoleType": "CustomRole",
"type": "Microsoft.Authorization/RoleDefinitions"
} |
Replace {your-existing-Role-definition-id} with your role definition id. In the section "AssignableScopes" add the string "/subscriptions/{subscription-id}" with your {subscription-id}.*Commonly used Azure built-in roles with necessary permissions:
Built-in Role | ID |
|---|---|
Reader |
|
Contributor |
|
Virtual Machine Contributor |
|
Virtual Network Contributor |
|
Storage Account Contributor |
|
Web Plan Contributor |
|
SQL server Contributor |
|
SQL DB Contributor |
|
4. Assign the custom role to a user in case you are adding a Native application, or to the application in case you are adding a Web app/API.
Custom role creation in Azure Portal is an asynchronous operation. This means that a time lag may take place.
5. Open the tab 'Review + Create'. Check the role details and click Create.
Update an Existing Cloudaware Custom Policy
...