You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/firewall/roles-permissions.md
+23-23Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,57 +5,57 @@ description: Learn about roles and permissions for Azure Firewall.
5
5
author: raboilla
6
6
ms.service: azure-firewall
7
7
ms.topic: concept-article
8
-
ms.date: 12/9/2024
8
+
ms.date: 03/28/2026
9
9
ms.author: duau
10
10
11
11
# Customer intent: "As an IT administrator, I want to configure roles and permissions for Azure Firewall, so that I can ensure the right access controls and functionalities are in place for users managing network resources."
12
12
---
13
13
# About roles and permissions for Azure Firewall
14
14
15
-
The Azure Firewall utilizes multiple resources, such as virtual networks and IP addresses, during both creation and management operations.
16
-
Because of this, it's essential to verify permissions on all involved resources during these operations.
15
+
Azure Firewall uses multiple resources, such as virtual networks and IP addresses, during both creation and management operations.
16
+
Because of this dependency, you need to verify permissions on all involved resources during these operations.
17
17
18
18
## Azure built-in roles
19
19
20
-
You can choose to assign [Azure built-in roles](../role-based-access-control/built-in-roles.md) to a user, group, service principal, or managed identity such as [Network contributor](../role-based-access-control/built-in-roles.md#network-contributor), which support all the required permissions for creating the gateway.
20
+
Assign [Azure built-in roles](../role-based-access-control/built-in-roles.md) to a user, group, service principal, or managed identity, such as [Network contributor](../role-based-access-control/built-in-roles.md#network-contributor), which supports all the required permissions for creating the gateway.
21
21
For more information, see [Steps to assign an Azure role](../role-based-access-control/role-assignments-steps.md).
22
22
23
23
## Custom roles
24
24
25
-
If the [Azure built-in roles](../role-based-access-control/built-in-roles.md) don't meet the specific needs of your organization, you can create your own custom roles.
26
-
Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.
27
-
For more information, see [Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role).
25
+
If the [Azure built-in roles](../role-based-access-control/built-in-roles.md) don't meet the specific needs of your organization, create your own custom roles.
26
+
Like built-in roles, assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.
27
+
For more information, see [Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role).
28
28
29
-
To ensure proper functionality, check your custom role permissions to confirm user service principals, and managed identities operating the Azure Firewall have the necessary permissions.
29
+
To ensure proper functionality, check your custom role permissions to confirm user service principals and managed identities operating the Azure Firewall have the necessary permissions.
30
30
To add any missing permissions listed here, see [Update a custom role](../role-based-access-control/custom-roles-portal.md#update-a-custom-role).
31
31
32
32
## Permissions
33
33
34
-
Depending on whether you're creating new resources or using existing ones, add the appropriate permissions from the following list for Azure Firewall in a Hub VNET:
34
+
Depending on whether you're creating new resources or using existing ones, add the appropriate permissions from the following list for Azure Firewall in a hub VNET:
35
35
36
-
|Resource | Resource status | Required Azure permissions |
36
+
|Resource | Resource status | Required Azure permissions |
For more information, see [Azure permissions for Networking](../role-based-access-control/permissions/networking.md) and [Virtual network permissions](../virtual-network/virtual-network-manage-subnet.md#permissions).
51
51
52
52
## Roles scope
53
53
54
-
In the process of custom role definition, you can specify a role assignment scope at four levels: management group, subscription, resource group, and resources. To grant access, you assign roles to users, groups, service principals, or managed identities at a particular scope.
54
+
When you create a custom role, specify a role assignment scope at one of four levels: management group, subscription, resource group, or resource. To grant access, assign roles to users, groups, service principals, or managed identities at a particular scope.
55
55
56
56
These scopes are structured in a parent-child relationship, with each level of hierarchy making the scope more specific. You can assign roles at any of these levels of scope, and the level you select determines how widely the role is applied.
57
57
58
-
For example, a role assigned at the subscription level can cascade down to all resources within that subscription, while a role assigned at the resource group level will only apply to resources within that specific group. Learn more about scope level
58
+
For example, a role assigned at the subscription level can cascade down to all resources within that subscription, while a role assigned at the resource group level only applies to resources within that specific group.
59
59
For more information, see [Scope levels](../role-based-access-control/scope-overview.md#scope-levels).
60
60
61
61
## Additional services
@@ -64,7 +64,7 @@ To view roles and permissions for other services, see the following links:
> Allow sufficient time for [Azure Resource Manager cache](../role-based-access-control/troubleshooting.md) to refresh after role assignment changes.
78
+
> After you change role assignments, allow sufficient time for [Azure Resource Manager cache](../role-based-access-control/troubleshooting.md) to refresh.
79
79
80
80
## Next steps
81
81
82
-
[What is Azure Role Based Access](../role-based-access-control/overview.md)
82
+
[What's Azure Role Based Access](../role-based-access-control/overview.md)
83
83
[Azure Role Based Access Control](/azure/role-based-access-control/role-assignments-list-portal)
0 commit comments