azureblog.co.uk
← cd ~/roles
// roles/azure · integration

API Management Service Workspace API Product ManagerAzure built-in role

Has the same access as API Management Service Workspace API Developer as well as read access to users and write access to allow assigning users to groups. This role should be assigned on the service scope.

Role IDd59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da
CategoryIntegration
Actions12
Data actions0

What it can do

PermissionWhat it allows
Microsoft.ApiManagement/service/users/readLists a collection of registered users in the specified service instance. or Gets the details of the user specified by its identifier.
Microsoft.ApiManagement/service/tags/readLists a collection of tags defined within a service instance. or Gets the details of the tag specified by its identifier.
Microsoft.ApiManagement/service/tags/apiLinks/*Every operation under Microsoft.ApiManagement/service/tags/apiLinks
Microsoft.ApiManagement/service/tags/operationLinks/*Every operation under Microsoft.ApiManagement/service/tags/operationLinks
Microsoft.ApiManagement/service/tags/productLinks/*Every operation under Microsoft.ApiManagement/service/tags/productLinks
Microsoft.ApiManagement/service/products/readLists a collection of products in the specified service instance. or Gets the details of the product specified by its identifier.
Microsoft.ApiManagement/service/products/apiLinks/*Every operation under Microsoft.ApiManagement/service/products/apiLinks
Microsoft.ApiManagement/service/groups/readLists a collection of groups defined within a service instance. or Gets the details of the group specified by its identifier.
Microsoft.ApiManagement/service/groups/users/*Every operation under Microsoft.ApiManagement/service/groups/users
Microsoft.ApiManagement/service/readRead metadata for an API Management Service instance
Microsoft.ApiManagement/service/authorizationServers/readLists a collection of authorization servers defined within a service instance. or Gets the details of the authorization server without secrets.
Microsoft.Authorization/*/readAny read operation on anything under Microsoft.Authorization

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "API Management Service Workspace API Product Manager" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "API Management Service Workspace API Product Manager" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'd59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other integration roles

Find the smallest role for a task →

Sources