azureblog.co.uk
← cd ~/roles
// roles/azure · ai-machine-learning

Healthcare Agent ReaderAzure built-in role

Users with reader access can sign in, have read-only access to the bot resources, scenarios and configuration setting except for the bot instance keys & secrets (including Authentication, Data Connection and Channels keys) and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs).

Role IDeb5a76d5-50e7-4c33-a449-070e7c9c4cf2
CategoryAi-machine-learning
Actions0
Data actions17

Before you assign it

  • It reaches the data, not just the resource. It has 17 data actions, such as reading blobs, secrets or messages.

What it can do

No control-plane actions.

Data actions

PermissionWhat it allows
Microsoft.HealthBot/healthBots/ResourceData/ReadGet global data and properties about Healthcare Agent service
Microsoft.HealthBot/healthBots/Metadata/ReadGet metadata and configurations related to the bot
Microsoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/ReadApply copilot features when opening the management portal
Microsoft.HealthBot/healthBots/Feedback/ReadParticipate and answer on surveys and feedbacks about Healthcare Agent service
Microsoft.HealthBot/healthBots/Users/ReadRead portal users as configured in classic access control
Microsoft.HealthBot/healthBots/AuditTrails/ReadAudit all activity in your bot
Microsoft.HealthBot/healthBots/AnalyticReport/ReadAccess for getting analytic report data
Microsoft.HealthBot/healthBots/ExposedSkill/ReadView the agent's exposed skill enablement status and details
Microsoft.HealthBot/healthBots/RegisteredSkills/ReadList registered skills and view manifest URLs and details
Microsoft.HealthBot/healthBots/Configuration/ReadView agent's configuration, including healthcare intelligence configurations and environment variables
Microsoft.HealthBot/healthBots/Localization/ReadAccess for getting language localization data
Microsoft.HealthBot/healthBots/AuthenticationProviders/ReadList and view details of agent's authentication providers
Microsoft.HealthBot/healthBots/DataConnections/ReadList and view details of reusable data connections
Microsoft.HealthBot/healthBots/OpenAPIPlugins/ReadList and view OpenAPI plugins' details
Microsoft.HealthBot/healthBots/Scenarios/*/ReadAny read operation on anything under Microsoft.HealthBot/healthBots/Scenarios
Microsoft.HealthBot/healthBots/LanguageModels/ReadAccess for getting language models data
Microsoft.HealthBot/healthBots/Resources/Files/ReadAllows reading and listing of resource files in the Health Bot.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Healthcare Agent Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Healthcare Agent Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'eb5a76d5-50e7-4c33-a449-070e7c9c4cf2')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eb5a76d5-50e7-4c33-a449-070e7c9c4cf2')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "eb5a76d5-50e7-4c33-a449-070e7c9c4cf2"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other ai-machine-learning roles

Find the smallest role for a task →

Sources