Skip to content

Commit 0446441

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #312310 from rolyon/rolyon-rbac-roles-feb-2026
[Azure RBAC] Roles and permissions for Feb 2026
2 parents d07a497 + 2ac3b76 commit 0446441

40 files changed

Lines changed: 667 additions & 177 deletions

‎articles/role-based-access-control/built-in-roles.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

@@ -399,10 +399,10 @@ The following table provides a brief description of each built-in role. Click th
399399
> | <a name='api-management-workspace-api-product-manager'></a>[API Management Workspace API Product Manager](./built-in-roles/integration.md#api-management-workspace-api-product-manager) | Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope. | 73c2c328-d004-4c5e-938c-35c6f5679a1f |
400400
> | <a name='api-management-workspace-contributor'></a>[API Management Workspace Contributor](./built-in-roles/integration.md#api-management-workspace-contributor) | Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope. | 0c34c906-8d99-4cb7-8bb7-33f5b0a1a799 |
401401
> | <a name='api-management-workspace-reader'></a>[API Management Workspace Reader](./built-in-roles/integration.md#api-management-workspace-reader) | Has read-only access to entities in the workspace. This role should be assigned on the workspace scope. | ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2 |
402-
> | <a name='app-configuration-contributor'></a>[App Configuration Contributor](./built-in-roles/integration.md#app-configuration-contributor) | Grants permission for all management operations, except purge, for App Configuration resources. | fe86443c-f201-4fc4-9d2a-ac61149fbda0 |
402+
> | <a name='app-configuration-contributor'></a>[App Configuration Contributor](./built-in-roles/integration.md#app-configuration-contributor) | Grants permission for all management operations, except purge, for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags. | fe86443c-f201-4fc4-9d2a-ac61149fbda0 |
403403
> | <a name='app-configuration-data-owner'></a>[App Configuration Data Owner](./built-in-roles/integration.md#app-configuration-data-owner) | Allows full access to App Configuration data. | 5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b |
404404
> | <a name='app-configuration-data-reader'></a>[App Configuration Data Reader](./built-in-roles/integration.md#app-configuration-data-reader) | Allows read access to App Configuration data. | 516239f1-63e1-4d78-a4de-a74fb236a071 |
405-
> | <a name='app-configuration-reader'></a>[App Configuration Reader](./built-in-roles/integration.md#app-configuration-reader) | Grants permission for read operations for App Configuration resources. | 175b81b9-6e0d-490a-85e4-0d422273c10c |
405+
> | <a name='app-configuration-reader'></a>[App Configuration Reader](./built-in-roles/integration.md#app-configuration-reader) | Grants permission for read operations for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags. | 175b81b9-6e0d-490a-85e4-0d422273c10c |
406406
> | <a name='azure-api-center-compliance-manager'></a>[Azure API Center Compliance Manager](./built-in-roles/integration.md#azure-api-center-compliance-manager) | Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project. Applies for new Foundry resources. | ede9aaa3-4627-494e-be13-4aa7c256148d |
407407
> | <a name='azure-api-center-data-reader'></a>[Azure API Center Data Reader](./built-in-roles/integration.md#azure-api-center-data-reader) | Allows for access to Azure API Center data plane read operations. | c7244dfb-f447-457d-b2ba-3999044d1706 |
408408
> | <a name='azure-api-center-service-contributor'></a>[Azure API Center Service Contributor](./built-in-roles/integration.md#azure-api-center-service-contributor) | Allows managing Azure API Center service. | dd24193f-ef65-44e5-8a7e-6fa6e03f7713 |

‎articles/role-based-access-control/built-in-roles/ai-machine-learning.md‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

@@ -342,6 +342,7 @@ Can approve private endpoint connections to Azure AI common dependency resources
342342
> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/privateLinkResources/read | Get the private link resources for the corresponding MySQL Server |
343343
> | [Microsoft.DBforMySQL](../permissions/databases.md#microsoftdbformysql)/flexibleServers/read | Returns the list of servers or gets the properties for the specified server. |
344344
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnectionsApproval/action | Manage a private endpoint connection of Database Account |
345+
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/operationResults/read | Read Status of privateEndpointConnections asynchronous operation |
345346
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/read | Read a private endpoint connection or list all the private endpoint connections of a Database Account |
346347
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateEndpointConnections/write | Create or update a private endpoint connection of a Database Account |
347348
> | [Microsoft.DocumentDB](../permissions/databases.md#microsoftdocumentdb)/databaseAccounts/privateLinkResources/read | Read a private link resource or list all the private link resources of a Database Account |
@@ -448,6 +449,7 @@ Can approve private endpoint connections to Azure AI common dependency resources
448449
"Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",
449450
"Microsoft.DBforMySQL/flexibleServers/read",
450451
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
452+
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",
451453
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
452454
"Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
453455
"Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
@@ -566,8 +568,16 @@ Grants full to manage AI project and accounts. Grants reader access to AI projec
566568
> [!div class="mx-tableFixed"]
567569
> | Actions | Description |
568570
> | --- | --- |
571+
> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/actionRules/* | |
572+
> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/alerts/* | |
573+
> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/issues/* | |
574+
> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/prometheusRuleGroups/* | |
575+
> | [Microsoft.AlertsManagement](../permissions/monitor.md#microsoftalertsmanagement)/smartDetectorAlertRules/* | |
569576
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
570577
> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/* | |
578+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/activityLogAlerts/* | |
579+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricalerts/* | |
580+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/scheduledqueryrules/* | |
571581
> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
572582
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
573583
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
@@ -594,8 +604,16 @@ Grants full to manage AI project and accounts. Grants reader access to AI projec
594604
"permissions": [
595605
{
596606
"actions": [
607+
"Microsoft.AlertsManagement/actionRules/*",
608+
"Microsoft.AlertsManagement/alerts/*",
609+
"Microsoft.AlertsManagement/issues/*",
610+
"Microsoft.AlertsManagement/prometheusRuleGroups/*",
611+
"Microsoft.AlertsManagement/smartDetectorAlertRules/*",
597612
"Microsoft.Authorization/*/read",
598613
"Microsoft.CognitiveServices/*",
614+
"Microsoft.Insights/activityLogAlerts/*",
615+
"Microsoft.Insights/metricalerts/*",
616+
"Microsoft.Insights/scheduledqueryrules/*",
599617
"Microsoft.ResourceHealth/availabilityStatuses/read",
600618
"Microsoft.Resources/deployments/*",
601619
"Microsoft.Resources/deployments/operations/read",
@@ -650,7 +668,7 @@ Lets you perform developer actions and management actions on Foundry Projects. I
650668
"assignableScopes": [
651669
"/"
652670
],
653-
"description": "Lets you perform developer actions and management actions on Microsoft Foundry Projects. Allows for making role assignments, but limited to Cognitive Service User role.",
671+
"description": "Lets you perform developer actions and management actions on Azure AI Foundry Projects. Allows for making role assignments, but limited to Cognitive Service User role.",
654672
"id": "/providers/Microsoft.Authorization/roleDefinitions/eadc314b-1a2d-4efa-be10-5d325db5065e",
655673
"name": "eadc314b-1a2d-4efa-be10-5d325db5065e",
656674
"permissions": [
@@ -2710,6 +2728,7 @@ Grants full access to Azure Cognitive Search index data.
27102728
> | *none* | |
27112729
> | **DataActions** | |
27122730
> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/indexes/documents/* | |
2731+
> | [Microsoft.Search](../permissions/ai-machine-learning.md#microsoftsearch)/searchServices/indexes/contentSecurity/elevatedOperations/read | Enable the option to read all documents in an index regardless of permission filters. |
27132732
> | **NotDataActions** | |
27142733
> | *none* | |
27152734
@@ -2726,7 +2745,8 @@ Grants full access to Azure Cognitive Search index data.
27262745
"actions": [],
27272746
"notActions": [],
27282747
"dataActions": [
2729-
"Microsoft.Search/searchServices/indexes/documents/*"
2748+
"Microsoft.Search/searchServices/indexes/documents/*",
2749+
"Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read"
27302750
],
27312751
"notDataActions": []
27322752
}

‎articles/role-based-access-control/built-in-roles/analytics.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

‎articles/role-based-access-control/built-in-roles/compute.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

‎articles/role-based-access-control/built-in-roles/containers.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

@@ -4868,6 +4868,7 @@ Grants Microsoft Defender for Cloud access to Azure Kubernetes Services
48684868
> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/read | Gets the feature of a subscription in a given resource provider. |
48694869
> | [Microsoft.Features](../permissions/management-and-governance.md#microsoftfeatures)/providers/features/register/action | Registers the feature for a subscription in a given resource provider. |
48704870
> | [Microsoft.Security](../permissions/security.md#microsoftsecurity)/pricings/securityoperators/read | Gets the security operators for the scope |
4871+
> | [Microsoft.Security](../permissions/security.md#microsoftsecurity)/securityOperators/read | Gets the securityoperators for the scope |
48714872
> | **NotActions** | |
48724873
> | *none* | |
48734874
> | **DataActions** | |
@@ -4893,7 +4894,8 @@ Grants Microsoft Defender for Cloud access to Azure Kubernetes Services
48934894
"Microsoft.Features/features/read",
48944895
"Microsoft.Features/providers/features/read",
48954896
"Microsoft.Features/providers/features/register/action",
4896-
"Microsoft.Security/pricings/securityoperators/read"
4897+
"Microsoft.Security/pricings/securityoperators/read",
4898+
"Microsoft.Security/securityOperators/read"
48974899
],
48984900
"notActions": [],
48994901
"dataActions": [],

‎articles/role-based-access-control/built-in-roles/databases.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

‎articles/role-based-access-control/built-in-roles/devops.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

‎articles/role-based-access-control/built-in-roles/general.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

‎articles/role-based-access-control/built-in-roles/hybrid-multicloud.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 12/31/2025
10+
ms.date: 02/23/2026
1111
ms.custom: generated
1212
---
1313

@@ -792,8 +792,8 @@ Grants full access to the cluster and its resources, including the ability to re
792792
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
793793
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/write | Creates or Updates Custom Location resource |
794794
> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/delete | Deletes Custom Location resource |
795-
> | Microsoft.EdgeMarketplace/offers/read | Get a Offer |
796-
> | Microsoft.EdgeMarketplace/publishers/read | Get a Publisher |
795+
> | [Microsoft.EdgeMarketplace](../permissions/internet-of-things.md#microsoftedgemarketplace)/offers/read | List Offer resources by parent |
796+
> | [Microsoft.EdgeMarketplace](../permissions/internet-of-things.md#microsoftedgemarketplace)/publishers/read | Get a Publisher |
797797
> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/register/action | Registers Subscription with Microsoft.Kubernetes resource provider |
798798
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/register/action | Registers subscription to Microsoft.KubernetesConfiguration resource provider. |
799799
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/write | Creates or updates extension resource. |
@@ -818,7 +818,7 @@ Grants full access to the cluster and its resources, including the ability to re
818818
> | **NotDataActions** | |
819819
> | *none* | |
820820
> | **Condition** | |
821-
> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7})) | Add or remove role assignments for the following roles:<br/>Azure Connected Machine Resource Manager<br/>Azure Connected Machine Resource Administrator<br/>Azure Connected Machine Onboarding<br/>Azure Stack HCI Connected InfraVMs<br/>Azure Stack HCI VM Reader<br/>Azure Stack HCI VM Contributor<br/>Azure Stack HCI Device Management Role<br/>Azure Resource Bridge Deployment Role<br/>Key Vault Secrets User<br/>Key Vault Secrets Officer |
821+
> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, a4417e6f-fecd-4de8-b567-7b0420556985})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, a4417e6f-fecd-4de8-b567-7b0420556985})) | Add or remove role assignments for the following roles:<br/>Azure Connected Machine Resource Manager<br/>Azure Connected Machine Resource Administrator<br/>Azure Connected Machine Onboarding<br/>Azure Stack HCI Connected InfraVMs<br/>Azure Stack HCI VM Reader<br/>Azure Stack HCI VM Contributor<br/>Azure Stack HCI Device Management Role<br/>Azure Resource Bridge Deployment Role<br/>Key Vault Secrets User<br/>Key Vault Secrets Officer<br/>Key Vault Certificates Officer |
822822
823823
```json
824824
{
@@ -939,7 +939,7 @@ Grants full access to the cluster and its resources, including the ability to re
939939
"dataActions": [],
940940
"notDataActions": [],
941941
"conditionVersion": "2.0",
942-
"condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7}))"
942+
"condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, a4417e6f-fecd-4de8-b567-7b0420556985})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, a4417e6f-fecd-4de8-b567-7b0420556985}))"
943943
}
944944
],
945945
"roleName": "Azure Stack HCI Administrator",

0 commit comments

Comments
 (0)