Merge pull request #258527 from RoseHJM/ade-deployment-environments-reader

ADE - deployment environments reader

Author: v-dirichards

articles/deployment-environments/how-to-configure-deployment-environments-user.md

@@ -13,16 +13,19 @@ ms.topic: how-to
 
 # Provide access for developers to projects in Deployment Environments 
 
-In Azure Deployment Environments, development team members must get access to a specific project before they can create deployment environments. By using the built-in Deployment Environments User role, you can assign permissions to Active Directory users or groups at either the project level or the environment type level. 
+In Azure Deployment Environments, development team members must have access to a project before they can create deployment environments. By using the built-in roles, Deployment Environments User and Deployment Environments Reader, you can assign permissions to Active Directory users or groups at either the project level or the environment type level. 
 
-Based on the scope of access that you allow, a developer who has the Deployment Environments User role can:
+When assigned at the project level, a developer who has the Deployment Environments User role can perform the following actions on all enabled project environment types:
 
 * View the project environment types. 
 * Create an environment.
 * Read, write, delete, or perform actions (like deploy or reset) on their own environment.
+
+A developer who has the Deployment Environments Reader role can:
+
 * Read environments that other users created.
 
-When you assign the role at the project level, the user can perform the preceding actions on all environment types enabled at the project level. When you assign the role to specific environment types, the user can perform the actions only on the respective environment types.
+ When you assign a role to specific environment types, the user can perform the actions only on the respective environment types.
 
 ## Assign permissions to developers for a project
 
@@ -42,7 +45,7 @@ When you assign the role at the project level, the user can perform the precedin
 
     :::image type="content" source="media/quickstart-create-configure-projects/add-role-assignment.png" alt-text="Screenshot that shows the Add role assignment pane.":::
 
-The users can now view the project and all the environment types that you've enabled within it. Users who have the Deployment Environments User role can also [create environments from the Azure CLI](./quickstart-create-access-environments.md).
+The users can now view the project and all the environment types enabled within it. Users who have the Deployment Environments User role can  [create environments in the developer portal](./quickstart-create-access-environments.md).
 
 ## Assign permissions to developers for an environment type
 
@@ -65,10 +68,9 @@ The users can now view the project and all the environment types that you've ena
 
     :::image type="content" source="media/quickstart-create-configure-projects/add-role-assignment.png" alt-text="Screenshot that shows the Add role assignment pane.":::
 
-The users can now view the project and the specific environment type that you've granted them access to. Users who have the Deployment Environments User role can also [create environments by using the Azure CLI](./quickstart-create-access-environments.md).
+The users can now view the project and the specific environment type that you granted them access to. Users who have the Deployment Environments User role can also [create environments in the developer portal](./quickstart-create-access-environments.md).
 
-> [!NOTE]
-> Only users who have the Deployment Environments User role, the DevCenter Project Admin role, or a built-in role with appropriate permissions can create environments.
+[!INCLUDE [note-deployment-environments-user](includes/note-deployment-environments-user.md)]
 
 ## Next steps
 

articles/deployment-environments/how-to-configure-project-admin.md

@@ -66,8 +66,7 @@ The users can now view the project and manage all the environment types that you
 
 The users can now view the project and manage only the specific environment type that you've granted them access to. DevCenter Project Admin users can also [create environments by using the Azure CLI](./quickstart-create-access-environments.md).
 
-> [!NOTE]
-> Only users who have the Deployment Environments User role, the DevCenter Project Admin role, or a built-in role with appropriate permissions can create environments.
+[!INCLUDE [note-deployment-environments-user](includes/note-deployment-environments-user.md)]
 
 ## Next steps
 

articles/deployment-environments/how-to-create-access-environments.md

@@ -26,8 +26,7 @@ Creating an environment automatically creates the required resources and a resou
 
 Complete the following steps in the Azure CLI to create an environment and configure resources. You can view the outputs as defined in the specific Azure Resource Manager template (ARM template).
 
-> [!NOTE]
-> Only a user who has the [Deployment Environments User](how-to-configure-deployment-environments-user.md) role, the [DevCenter Project Admin](how-to-configure-project-admin.md) role, or a [built-in role](../role-based-access-control/built-in-roles.md) that has the required permissions can create an environment.
+[!INCLUDE [note-deployment-environments-user](includes/note-deployment-environments-user.md)]
 
 1. Sign in to the Azure CLI:
 

articles/deployment-environments/how-to-create-configure-projects.md

@@ -168,8 +168,7 @@ In this quickstart, you give access to your own ID. Optionally, you can replace
     ```
 
 
-> [!NOTE]
-> Only a user who has the [Deployment Environments User](how-to-configure-deployment-environments-user.md) role, the [DevCenter Project Admin](how-to-configure-project-admin.md) role, or a built-in role that has appropriate permissions can create an environment.
+[!INCLUDE [note-deployment-environments-user](includes/note-deployment-environments-user.md)]
 
 ## Next steps
 

articles/deployment-environments/includes/note-deployment-environments-user.md

@@ -0,0 +1,10 @@
+---
+ms.service: deployment-environments
+ms.topic: include
+author: RoseHJM
+ms.author: rosemalcolm
+ms.date: 11/14/2023
+---
+
+> [!NOTE]
+> Only users who have the [Deployment Environments User](../how-to-configure-deployment-environments-user.md) role, the [DevCenter Project Admin](../how-to-configure-project-admin.md) role, or a built-in role that has appropriate permissions can create an environment. Users who have the [Deployment Environments Reader](../how-to-configure-deployment-environments-user.md) role can view their own environments, and environments created by others.

articles/deployment-environments/overview-what-is-azure-deployment-environments.md

@@ -48,17 +48,18 @@ Developers have the following self-service experience when working with [environ
 
 ### Platform engineering scenarios
 
-Azure Deployment Environments helps your platform engineer apply the right set of policies and settings on various types of environments, control the resource configuration that developers can create, and centrally track environments across projects by doing the following tasks:  
+Azure Deployment Environments helps your platform engineer apply the right set of policies and settings on various types of environments, control the resource configuration that developers can create, and track environments across projects. They perform the following tasks:  
 
 - Provide a project-based, curated set of reusable IaC templates.
 - Define specific Azure deployment configurations per project and per environment type.
 - Provide a self-service experience without giving control over subscriptions.
 - Track costs and ensure compliance with enterprise governance policies.
 
-Azure Deployment Environments supports two [built-in roles](../role-based-access-control/built-in-roles.md):
+Azure Deployment Environments supports three [built-in roles](../role-based-access-control/built-in-roles.md):
 
 - **Dev Center Project Admin**: Creates environments and manages the environment types for a project.
-- **Deployment Environments User**: Creates environments based on appropriate access. 
+- **Deployment Environments User**: Creates environments based on appropriate access.
+- **Deployment Environments Reader**: Reads environments that other users created. 
 
 
 ## Benefits
@@ -84,7 +85,7 @@ Use APIs to provision environments directly from your preferred CI tool, integra
 
 [Microsoft Dev Box](../dev-box/overview-what-is-microsoft-dev-box.md) and Azure Deployment Environments are complementary services that share certain architectural components. Dev Box provides developers with a cloud-based development workstation, called a dev box, which is configured with the tools they need for their work. Dev centers and projects are common to both services, and they help organize resources in an enterprise.
 
-When configuring Deployment Environments, you may see Dev Box resources and components. You may even see informational messages regarding Dev Box features. If you're not configuring any Dev Box features, you can safely ignore these messages.
+When configuring Deployment Environments, you might see Dev Box resources and components. You might even see informational messages regarding Dev Box features. If you're not configuring any Dev Box features, you can safely ignore these messages.
 
 ## Next steps
 Start using Azure Deployment Environments:

articles/deployment-environments/quickstart-create-access-environments.md

@@ -30,8 +30,7 @@ In this quickstart, you learn how to:
 
 An environment in Azure Deployment Environments is a collection of Azure resources on which your application is deployed. You can create an environment from the developer portal.
 
-> [!NOTE]
-> Only a user who has the [Deployment Environments User](how-to-configure-deployment-environments-user.md) role, the [DevCenter Project Admin](how-to-configure-project-admin.md) role, or a [built-in role](../role-based-access-control/built-in-roles.md) that has appropriate permissions can create an environment.
+[!INCLUDE [note-deployment-environments-user](includes/note-deployment-environments-user.md)]
 
 1. Sign in to the [developer portal](https://devportal.microsoft.com).
 1. From the **New** menu at the top left, select **New environment**.
@@ -49,7 +48,7 @@ An environment in Azure Deployment Environments is a collection of Azure resourc
 
    :::image type="content" source="media/quickstart-create-access-environments/add-environment.png" alt-text="Screenshot showing add environment pane.":::
 
-If your environment is configured to accept parameters, you're able to enter them on a separate pane. In this example, you don't need to specify any parameters.
+   If your environment is configured to accept parameters, you're able to enter them on a separate pane. In this example, you don't need to specify any parameters.
 
 1. Select **Create**. You see your environment in the developer portal immediately, with an indicator that shows creation in progress.
 

articles/deployment-environments/quickstart-create-and-configure-projects.md

@@ -78,7 +78,7 @@ To configure a project, add a [project environment type](how-to-configure-projec
     |---------|----------|
     |**Type**| Select a dev center level environment type to enable for the specific project.|
     |**Deployment subscription**| Select the subscription in which the environment is created.|
-    |**Deployment identity** | Select either a system-assigned identity or a user-assigned managed identity that's used to perform deployments on behalf of the user.|
+    |**Deployment identity** | Select either a system-assigned identity or a user-assigned managed identity to perform deployments on behalf of the user.|
     |**Permissions on environment resources** > **Environment creator role(s)**|  Select the roles to give access to the environment resources.|
     |**Permissions on environment resources** > **Additional access** | Select the users or Microsoft Entra groups to assign to specific roles on the environment resources.|
     |**Tags** | Enter a tag name and a tag value. These tags are applied on all resources that are created as part of the environment.|
@@ -108,8 +108,8 @@ Before developers can create environments based on the environment types in a pr
 
     :::image type="content" source="media/quickstart-create-configure-projects/add-role-assignment.png" alt-text="Screenshot that shows the Add role assignment pane.":::
 
-> [!NOTE]
-> Only a user who has the [Deployment Environments User](how-to-configure-deployment-environments-user.md) role, the [DevCenter Project Admin](how-to-configure-project-admin.md) role, or a built-in role that has appropriate permissions can create an environment.
+[!INCLUDE [note-deployment-environments-user](includes/note-deployment-environments-user.md)]
+
 
 ## Next steps