← cd ~/roles
// roles/azure · management-and-governance
Quota Request OperatorAzure built-in role
Read and create quota requests, get quota request status, and create support tickets.
| Role ID | 0e5f05e5-9ab9-446b-b98d-1e2157c94125 |
|---|---|
| Category | Management-and-governance |
| Actions | 14 |
| Data actions | 0 |
What it can do
| Permission | What it allows |
|---|---|
Microsoft.Capacity/resourceProviders/locations/serviceLimits/read | Get the current service limit or quota of the specified resource and location |
Microsoft.Capacity/resourceProviders/locations/serviceLimits/write | Create service limit or quota for the specified resource and location |
Microsoft.Capacity/resourceProviders/locations/serviceLimitsRequests/read | Get any service limit request for the specified resource and location |
Microsoft.Capacity/register/action | Registers the Capacity resource provider and enables the creation of Capacity resources. |
Microsoft.Quota/usages/read | Get the usages for resource providers |
Microsoft.Quota/quotas/read | Get the current Service limit or quota of the specified resource |
Microsoft.Quota/quotas/write | Creates the service limit or quota request for the specified resource |
Microsoft.Quota/quotaRequests/read | Get any service limit request for the specified resource |
Microsoft.Quota/register/action | Register the subscription with Microsoft.Quota Resource Provider |
Microsoft.Authorization/*/read | Any read operation on anything under Microsoft.Authorization |
Microsoft.Insights/alertRules/* | Every operation under Microsoft.Insights/alertRules |
Microsoft.Resources/deployments/* | Every operation under Microsoft.Resources/deployments |
Microsoft.Resources/subscriptions/resourceGroups/read | Gets or lists resource groups. |
Microsoft.Support/* | Every operation under Microsoft.Support |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Quota Request Operator" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Quota Request Operator" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, '0e5f05e5-9ab9-446b-b98d-1e2157c94125')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e5f05e5-9ab9-446b-b98d-1e2157c94125')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "0e5f05e5-9ab9-446b-b98d-1e2157c94125"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other management-and-governance roles
- Service Group Contributor · 1 permission
- Template Spec Reader · 1 permission
- Carbon Optimization Reader · 2 permissions
- Hierarchy Settings Administrator · 2 permissions
- Reservations Reader · 2 permissions
- Service Group Reader · 2 permissions
- Advisor Reviews Reader · 3 permissions
- Managed Application Operator Role · 3 permissions