azureblog.co.uk
← cd ~/roles
// roles/azure · ai-machine-learning

Healthcare Agent EditorAzure built-in role

Users with editor access can sign in, view and edit all the bot resources, scenarios and configuration setting except for the bot instance keys & secrets and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). A read-only access to the bot skills and channels.

Role IDaf854a69-80ce-4ff7-8447-f1118a2e0ca8
CategoryAi-machine-learning
Actions0
Data actions18

Before you assign it

  • It reaches the data, not just the resource. It has 18 data actions, such as reading blobs, secrets or messages.

What it can do

No control-plane actions.

Data actions

PermissionWhat it allows
Microsoft.HealthBot/healthBots/ResourceData/ReadGet global data and properties about Healthcare Agent service
Microsoft.HealthBot/healthBots/Metadata/ReadGet metadata and configurations related to the bot
Microsoft.HealthBot/healthBots/CopilotStudioSolution/*Every operation under Microsoft.HealthBot/healthBots/CopilotStudioSolution
Microsoft.HealthBot/healthBots/Feedback/ReadParticipate and answer on surveys and feedbacks about Healthcare Agent service
Microsoft.HealthBot/healthBots/Users/ReadRead portal users as configured in classic access control
Microsoft.HealthBot/healthBots/AuditTrails/ReadAudit all activity in your bot
Microsoft.HealthBot/healthBots/AnalyticReport/ReadAccess for getting analytic report data
Microsoft.HealthBot/healthBots/ExposedSkill/ReadView the agent's exposed skill enablement status and details
Microsoft.HealthBot/healthBots/RegisteredSkills/ReadList registered skills and view manifest URLs and details
Microsoft.HealthBot/healthBots/Configuration/*Every operation under Microsoft.HealthBot/healthBots/Configuration
Microsoft.HealthBot/healthBots/Localization/*Every operation under Microsoft.HealthBot/healthBots/Localization
Microsoft.HealthBot/healthBots/AuthenticationProviders/*Every operation under Microsoft.HealthBot/healthBots/AuthenticationProviders
Microsoft.HealthBot/healthBots/Channels/*Every operation under Microsoft.HealthBot/healthBots/Channels
Microsoft.HealthBot/healthBots/DataConnections/*Every operation under Microsoft.HealthBot/healthBots/DataConnections
Microsoft.HealthBot/healthBots/OpenAPIPlugins/*Every operation under Microsoft.HealthBot/healthBots/OpenAPIPlugins
Microsoft.HealthBot/healthBots/Scenarios/*Every operation under Microsoft.HealthBot/healthBots/Scenarios
Microsoft.HealthBot/healthBots/LanguageModels/*Every operation under Microsoft.HealthBot/healthBots/LanguageModels
Microsoft.HealthBot/healthBots/Resources/*Every operation under Microsoft.HealthBot/healthBots/Resources

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Healthcare Agent Editor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Healthcare Agent Editor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'af854a69-80ce-4ff7-8447-f1118a2e0ca8')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'af854a69-80ce-4ff7-8447-f1118a2e0ca8')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "af854a69-80ce-4ff7-8447-f1118a2e0ca8"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

Find the smallest role for a task →

Sources