azureblog.co.uk
← cd ~/roles
// roles/azure · devops

DevTest Labs UserAzure built-in role

Lets you connect, start, restart, and shutdown your virtual machines in your Azure DevTest Labs.

Role ID76283e04-6283-4c54-8f91-bcf1374a3c64
CategoryDevops
Actions32 (minus 1 NotActions)
Data actions0

What it can do

PermissionWhat it allows
Microsoft.Authorization/*/readAny read operation on anything under Microsoft.Authorization
Microsoft.Compute/availabilitySets/readGet the properties of an availability set
Microsoft.Compute/virtualMachines/*/readAny read operation on anything under Microsoft.Compute/virtualMachines
Microsoft.Compute/virtualMachines/deallocate/actionPowers off the virtual machine and releases the compute resources
Microsoft.Compute/virtualMachines/readGet the properties of a virtual machine
Microsoft.Compute/virtualMachines/restart/actionRestarts the virtual machine
Microsoft.Compute/virtualMachines/start/actionStarts the virtual machine
Microsoft.DevTestLab/*/readAny read operation on anything under Microsoft.DevTestLab
Microsoft.DevTestLab/labs/claimAnyVm/actionClaim a random claimable virtual machine in the lab.
Microsoft.DevTestLab/labs/createEnvironment/actionCreate virtual machines in a lab.
Microsoft.DevTestLab/labs/ensureCurrentUserProfile/actionEnsure the current user has a valid profile in the lab.
Microsoft.DevTestLab/labs/formulas/deleteDelete formulas.
Microsoft.DevTestLab/labs/formulas/readRead formulas.
Microsoft.DevTestLab/labs/formulas/writeAdd or modify formulas.
Microsoft.DevTestLab/labs/policySets/evaluatePolicies/actionEvaluates lab policy.
Microsoft.DevTestLab/labs/virtualMachines/claim/actionTake ownership of an existing virtual machine
Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/actionLists the applicable start/stop schedules, if any.
Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/actionGets a string that represents the contents of the RDP file for the virtual machine
Microsoft.Network/loadBalancers/backendAddressPools/join/actionJoins a load balancer backend address pool. Not Alertable.
Microsoft.Network/loadBalancers/inboundNatRules/join/actionJoins a load balancer inbound nat rule. Not Alertable.
Microsoft.Network/networkInterfaces/*/readAny read operation on anything under Microsoft.Network/networkInterfaces
Microsoft.Network/networkInterfaces/join/actionJoins a Virtual Machine to a network interface. Not Alertable.
Microsoft.Network/networkInterfaces/readGets a network interface definition.
Microsoft.Network/networkInterfaces/writeCreates a network interface or updates an existing network interface.
Microsoft.Network/publicIPAddresses/*/readAny read operation on anything under Microsoft.Network/publicIPAddresses
Microsoft.Network/publicIPAddresses/join/actionJoins a public IP address. Not Alertable.
Microsoft.Network/publicIPAddresses/readGets a public IP address definition.
Microsoft.Network/virtualNetworks/subnets/join/actionJoins a virtual network. Not Alertable.
Microsoft.Resources/deployments/operations/readGets or lists deployment operations.
Microsoft.Resources/deployments/readGets or lists deployments.
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Storage/storageAccounts/listKeys/actionReturns the access keys for the specified storage account.

Can't do

These are taken away from the actions above.

PermissionWhat it allows
Microsoft.Compute/virtualMachines/vmSizes/readLists available sizes the virtual machine can be updated to

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "DevTest Labs User" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "DevTest Labs User" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '76283e04-6283-4c54-8f91-bcf1374a3c64')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "76283e04-6283-4c54-8f91-bcf1374a3c64"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other devops roles

Find the smallest role for a task →

Sources