azureblog.co.uk
← cd ~/roles
// roles/azure · management-and-governance

Managed Application Publisher OperatorAzure built-in role

Allows the publisher to read resources in the managed resource group for Managed Application and request JIT access for additional operations. This role is only used by the Managed Application service to provide access to publishers.

Role IDb9331d33-8a36-4f8c-b097-4f54124fdb44
CategoryManagement-and-governance
Actions3
Data actions0

What it can do

PermissionWhat it allows
*/readEvery operation matching */read
Microsoft.Resources/deployments/*Every operation under Microsoft.Resources/deployments
Microsoft.Solutions/jitRequests/*Every operation under Microsoft.Solutions/jitRequests

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Managed Application Publisher Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Managed Application Publisher Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'b9331d33-8a36-4f8c-b097-4f54124fdb44')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b9331d33-8a36-4f8c-b097-4f54124fdb44')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "b9331d33-8a36-4f8c-b097-4f54124fdb44"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Find the smallest role for a task →

Sources