azure-rbac | 易学教程

How to assign an application role to a managed identity in the ARM template

阅读更多关于 How to assign an application role to a managed identity in the ARM template

问题 I have the following scenario. My application registration defines a set of application roles I dynamically deploy a scaleset with a System assigned managed identity via ARM template During the deployment i want to assign that identity to one of the specific application role defined above I update my deployment template with the following resource { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2017-09-01", "name": "<random Guid>", "dependsOn": [ "[concat('Microsoft

How to assign an application role to a managed identity in the ARM template

阅读更多关于 How to assign an application role to a managed identity in the ARM template

Grant access to Azure Data Lake Gen2 Access via ACLs only (no RBAC)

阅读更多关于 Grant access to Azure Data Lake Gen2 Access via ACLs only (no RBAC)

来源： https://stackoverflow.com/questions/60492680/grant-access-to-azure-data-lake-gen2-access-via-acls-only-no-rbac

Azure Policy not denying Custom Role creation

阅读更多关于 Azure Policy not denying Custom Role creation

问题 I am currently helping investigate adopting Azure for my organization's public cloud. One of the tasks I have been assigned is locking down accounts to prevent users from being able to elevate their permissions within a subscription. One of the things in particular I am interested in is denying the creation of Custom Roles, as we don't want people to go and start creating their own roles until the need for the role has been vetted by security. I have been trying to do this via an Azure policy

Azure PowerShell or CLI command to Provide a User with Owner access to a specific Web Application

阅读更多关于 Azure PowerShell or CLI command to Provide a User with Owner access to a specific Web Application

问题 I have around 100 Azure Web Apps and Azure Functions which I created using Azure PowerShell and CLI, now I need to assign Owner Access to these Web Apps to users (Separate users for each Web Apps) I am unable to find any sample for this, most sample are pointing to Assigning Resource Group Level Access, but not to the Specific Resource. The task is achievable in the Azure Portal, just need the PowerShell or CLI command to assign users owner or contributor rights to these specific resources.

Microsoft Graph list RBACRoleAssignments by resourceScope

阅读更多关于 Microsoft Graph list RBACRoleAssignments by resourceScope

问题 I would like list roleAssignments of a group with GraphAPI. But I only see an API to list whole roleAssignments. I tried to filter by resourceScopes/scopeMembers using $filter clause but it's not working. Should I filter this whole list myself or is there any other way to do it? 回答1: It seems like you are looking for Azure RBAC role assignments. These are different from what you've linked to, which are Intune device management role assignments (which are specific to Intune RBAC roles). They

RBAC access to Azure Storage - preview roles not acting as expected

阅读更多关于 RBAC access to Azure Storage - preview roles not acting as expected

问题 I'm trying to give our operations team read-only access to a storage account containing log files. I'd like to be able to give them the right to enumerate containers and read blobs. Ideally that would be the extent of their access. There are a couple of RBAC roles in preview that looked promising: Storage Blob Data Reader (Preview) is described as "Allows for read access to Azure Storage blobs containers and data" which sounds exactly like what I'm after Storage Blob Data Contributor (Preview

RBAC access to Azure Storage - preview roles not acting as expected

阅读更多关于 RBAC access to Azure Storage - preview roles not acting as expected

I'm trying to give our operations team read-only access to a storage account containing log files. I'd like to be able to give them the right to enumerate containers and read blobs. Ideally that would be the extent of their access. There are a couple of RBAC roles in preview that looked promising: Storage Blob Data Reader (Preview) is described as "Allows for read access to Azure Storage blobs containers and data" which sounds exactly like what I'm after Storage Blob Data Contributor (Preview) sounds like read/write to blob accounts Neither of these roles worked for me, however. The operations