azureblog.co.uk
← cd ~/roles
// roles/azure · ai-machine-learning

Healthcare Agent AdminAzure built-in role

Users with admin access can sign in, view and edit all of the bot resources, scenarios and configuration setting including the bot instance keys & secrets.

Role IDf1082fec-a70f-419f-9230-885d2550fb38
CategoryAi-machine-learning
Actions0
Data actions19

Before you assign it

  • It reaches the data, not just the resource. It has 19 data actions, such as reading blobs, secrets or messages.

What it can do

No control-plane actions.

Data actions

PermissionWhat it allows
Microsoft.HealthBot/healthBots/ResourceData/ReadGet global data and properties about Healthcare Agent service
Microsoft.HealthBot/healthBots/Metadata/ReadGet metadata and configurations related to the bot
Microsoft.HealthBot/healthBots/CopilotStudioSolution/*Every operation under Microsoft.HealthBot/healthBots/CopilotStudioSolution
Microsoft.HealthBot/healthBots/Feedback/ReadParticipate and answer on surveys and feedbacks about Healthcare Agent service
Microsoft.HealthBot/healthBots/Users/ReadRead portal users as configured in classic access control
Microsoft.HealthBot/healthBots/AuditTrails/ReadAudit all activity in your bot
Microsoft.HealthBot/healthBots/AnalyticReport/ReadAccess for getting analytic report data
Microsoft.HealthBot/healthBots/ExposedSkill/ReadView the agent's exposed skill enablement status and details
Microsoft.HealthBot/healthBots/RegisteredSkills/ReadList registered skills and view manifest URLs and details
Microsoft.HealthBot/healthBots/Configuration/*Every operation under Microsoft.HealthBot/healthBots/Configuration
Microsoft.HealthBot/healthBots/Localization/*Every operation under Microsoft.HealthBot/healthBots/Localization
Microsoft.HealthBot/healthBots/AuthenticationProviders/*Every operation under Microsoft.HealthBot/healthBots/AuthenticationProviders
Microsoft.HealthBot/healthBots/Channels/*Every operation under Microsoft.HealthBot/healthBots/Channels
Microsoft.HealthBot/healthBots/DataConnections/*Every operation under Microsoft.HealthBot/healthBots/DataConnections
Microsoft.HealthBot/healthBots/OpenAPIPlugins/*Every operation under Microsoft.HealthBot/healthBots/OpenAPIPlugins
Microsoft.HealthBot/healthBots/Scenarios/*Every operation under Microsoft.HealthBot/healthBots/Scenarios
Microsoft.HealthBot/healthBots/LanguageModels/*Every operation under Microsoft.HealthBot/healthBots/LanguageModels
Microsoft.HealthBot/healthBots/Resources/*Every operation under Microsoft.HealthBot/healthBots/Resources
Microsoft.HealthBot/healthBots/Admin/*Every operation under Microsoft.HealthBot/healthBots/Admin

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Healthcare Agent Admin" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Healthcare Agent Admin" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'f1082fec-a70f-419f-9230-885d2550fb38')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1082fec-a70f-419f-9230-885d2550fb38')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "f1082fec-a70f-419f-9230-885d2550fb38"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

Find the smallest role for a task →

Sources