Skip to content

Commit 938d2f0

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #312809 from rolyon/rolyon-rbac-roles-compute-limit-operator
[Azure RBAC] Compute Limit Operator
2 parents 3bab368 + b880691 commit 938d2f0

5 files changed

Lines changed: 79 additions & 3 deletions

File tree

‎articles/role-based-access-control/built-in-roles.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ The following table provides a brief description of each built-in role. Click th
5353
> | <a name='compute-gallery-artifacts-publisher'></a>[Compute Gallery Artifacts Publisher](./built-in-roles/compute.md#compute-gallery-artifacts-publisher) | This is the role for publishing gallery artifacts. | 85a2d0d9-2eba-4c9c-b355-11c2cc0788ab |
5454
> | <a name='compute-gallery-image-reader'></a>[Compute Gallery Image Reader](./built-in-roles/compute.md#compute-gallery-image-reader) | This is the role for reading gallery images. | cf7c76d2-98a3-4358-a134-615aa78bf44d |
5555
> | <a name='compute-gallery-sharing-admin'></a>[Compute Gallery Sharing Admin](./built-in-roles/compute.md#compute-gallery-sharing-admin) | This role allows user to share gallery to another subscription/tenant or share it to the public. | 1ef6a3be-d0ac-425d-8c01-acb62866290b |
56+
> | <a name='compute-limit-operator'></a>[Compute Limit Operator](./built-in-roles/compute.md#compute-limit-operator) | Read and manage compute limits using compute limit operations. | 980cf6f7-edec-4fd1-8e9e-28f70b1d5258 |
5657
> | <a name='data-operator-for-managed-disks'></a>[Data Operator for Managed Disks](./built-in-roles/compute.md#data-operator-for-managed-disks) | Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication. | 959f8984-c045-4866-89c7-12bf9737be2e |
5758
> | <a name='desktop-virtualization-application-group-contributor'></a>[Desktop Virtualization Application Group Contributor](./built-in-roles/compute.md#desktop-virtualization-application-group-contributor) | Contributor of the Desktop Virtualization Application Group. | 86240b0e-9422-4c43-887b-b61143f32ba8 |
5859
> | <a name='desktop-virtualization-application-group-reader'></a>[Desktop Virtualization Application Group Reader](./built-in-roles/compute.md#desktop-virtualization-application-group-reader) | Reader of the Desktop Virtualization Application Group. | aebf23d0-b568-4e86-b8f9-fe83a2c6ab55 |

‎articles/role-based-access-control/built-in-roles/compute.md‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10-
ms.date: 02/23/2026
10+
ms.date: 03/08/2026
1111
ms.custom: generated
1212
---
1313

@@ -646,6 +646,63 @@ This role allows user to share gallery to another subscription/tenant or share i
646646
}
647647
```
648648

649+
## Compute Limit Operator
650+
651+
Read and manage compute limits using compute limit operations.
652+
653+
> [!div class="mx-tableFixed"]
654+
> | Actions | Description |
655+
> | --- | --- |
656+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/guestSubscriptions/read | Reads guest subscriptions for a given host subscription within a location. |
657+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/guestSubscriptions/write | Adds a subscription as a guest to consume a host subscription's shared compute limits. |
658+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/guestSubscriptions/delete | Removes a subscription as a guest preventing it from consuming the host subscription's shared compute limits. |
659+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/sharedLimits/read | Lists all compute shared limits a host subscription shares with its guest subscriptions. |
660+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/sharedLimits/write | Enables sharing of a compute limit by a host subscription with its guest subscriptions. |
661+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/sharedLimits/delete | Disables sharing of a compute limit by a host subscription with its guest subscriptions. |
662+
> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/register/action | Registers the subscription for the Compute Limit resource provider and enables the management of compute limit resources. |
663+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
664+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
665+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
666+
> | **NotActions** | |
667+
> | *none* | |
668+
> | **DataActions** | |
669+
> | *none* | |
670+
> | **NotDataActions** | |
671+
> | *none* | |
672+
673+
```json
674+
{
675+
"assignableScopes": [
676+
"/"
677+
],
678+
"description": "Read and manage compute limits using compute limit operations.",
679+
"id": "/providers/Microsoft.Authorization/roleDefinitions/980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
680+
"name": "980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
681+
"permissions": [
682+
{
683+
"actions": [
684+
"Microsoft.ComputeLimit/locations/guestSubscriptions/read",
685+
"Microsoft.ComputeLimit/locations/guestSubscriptions/write",
686+
"Microsoft.ComputeLimit/locations/guestSubscriptions/delete",
687+
"Microsoft.ComputeLimit/locations/sharedLimits/read",
688+
"Microsoft.ComputeLimit/locations/sharedLimits/write",
689+
"Microsoft.ComputeLimit/locations/sharedLimits/delete",
690+
"Microsoft.ComputeLimit/register/action",
691+
"Microsoft.Insights/alertRules/*",
692+
"Microsoft.Resources/deployments/*",
693+
"Microsoft.Resources/subscriptions/resourceGroups/read"
694+
],
695+
"notActions": [],
696+
"dataActions": [],
697+
"notDataActions": []
698+
}
699+
],
700+
"roleName": "Compute Limit Operator",
701+
"roleType": "BuiltInRole",
702+
"type": "Microsoft.Authorization/roleDefinitions"
703+
}
704+
```
705+
649706
## Data Operator for Managed Disks
650707

651708
Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.

‎articles/role-based-access-control/permissions/compute.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.topic: generated-reference
66
author: rolyon
77
manager: pmwongera
88
ms.author: rolyon
9-
ms.date: 02/23/2026
9+
ms.date: 03/08/2026
1010
ms.custom: generated
1111
---
1212

@@ -1026,6 +1026,22 @@ Azure service: [Virtual Machines](/azure/virtual-machines/), [Virtual Machine Sc
10261026
> | Microsoft.Compute/virtualMachines/loginAsAdmin/action | Log in to a virtual machine with Windows administrator or Linux root user privileges |
10271027
> | Microsoft.Compute/virtualMachines/WACloginAsAdmin/action | Lets you manage the OS of your resource via Windows Admin Center as an administrator |
10281028
1029+
## Microsoft.ComputeLimit
1030+
1031+
Azure service: Microsoft Compute Limit
1032+
1033+
> [!div class="mx-tableFixed"]
1034+
> | Action | Description |
1035+
> | --- | --- |
1036+
> | Microsoft.ComputeLimit/register/action | Registers the subscription for the Compute Limit resource provider and enables the management of compute limit resources. |
1037+
> | Microsoft.ComputeLimit/locations/guestSubscriptions/read | Reads guest subscriptions for a given host subscription within a location. |
1038+
> | Microsoft.ComputeLimit/locations/guestSubscriptions/write | Adds a subscription as a guest to consume a host subscription's shared compute limits. |
1039+
> | Microsoft.ComputeLimit/locations/guestSubscriptions/delete | Removes a subscription as a guest preventing it from consuming the host subscription's shared compute limits. |
1040+
> | Microsoft.ComputeLimit/locations/sharedLimits/read | Lists all compute shared limits a host subscription shares with its guest subscriptions. |
1041+
> | Microsoft.ComputeLimit/locations/sharedLimits/write | Enables sharing of a compute limit by a host subscription with its guest subscriptions. |
1042+
> | Microsoft.ComputeLimit/locations/sharedLimits/delete | Disables sharing of a compute limit by a host subscription with its guest subscriptions. |
1043+
> | Microsoft.ComputeLimit/operations/read | Reads all available operations for the Microsoft.ComputeLimit resource provider. |
1044+
10291045
## Microsoft.ComputeSchedule
10301046

10311047
Azure service: [Azure Virtual Desktop](/azure/virtual-desktop/overview)

‎articles/role-based-access-control/resource-provider-operations.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ Click the resource provider name in the following list to see the list of permis
4545
> | [Microsoft.Batch](./permissions/compute.md#microsoftbatch) | Cloud-scale job scheduling and compute management. | [Batch](/azure/batch/) |
4646
> | [Microsoft.ClassicCompute](./permissions/compute.md#microsoftclassiccompute) | | Classic deployment model virtual machine |
4747
> | [Microsoft.Compute](./permissions/compute.md#microsoftcompute) | Access cloud compute capacity and scale on demand (such as virtual machines) and only pay for the resources you use. | [Virtual Machines](/azure/virtual-machines/)<br/>[Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/) |
48+
> | [Microsoft.ComputeLimit](./permissions/compute.md#microsoftcomputelimit) | | |
4849
> | [Microsoft.ComputeSchedule](./permissions/compute.md#microsoftcomputeschedule) | | [Azure Virtual Desktop](/azure/virtual-desktop/overview) |
4950
> | [microsoft.connectedvmwarevsphere](./permissions/compute.md#microsoftconnectedvmwarevsphere) | | [Azure Arc-enabled VMware vSphere](/azure/azure-arc/vmware-vsphere/) |
5051
> | [Microsoft.DesktopVirtualization](./permissions/compute.md#microsoftdesktopvirtualization) | The best virtual desktop experience, delivered on Azure. | [Azure Virtual Desktop](/azure/virtual-desktop/) |

‎articles/role-based-access-control/whats-new.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: rolyon
55
manager: pmwongera
66
ms.service: role-based-access-control
77
ms.topic: whats-new
8-
ms.date: 02/26/2026
8+
ms.date: 03/08/2026
99
ms.author: rolyon
1010

1111
---
@@ -18,6 +18,7 @@ This article provides information about new features and documentation improveme
1818

1919
| Date | Area | Description |
2020
| --- | --- | --- |
21+
| March 2026 | Roles | Added [Compute Limit Operator](./built-in-roles/compute.md#compute-limit-operator) role. |
2122
| February 2026 | Roles and permissions | Updated permissions for several roles and resource providers. See [Azure built-in roles](built-in-roles.md) and [Azure permissions](resource-provider-operations.md). |
2223
| February 2026 | Classic administrators | Update steps to reflect that Azure Resource Graph will no longer list classic administrators. See [Azure classic subscription administrators](classic-administrators.md). |
2324

0 commit comments

Comments
 (0)