← cd ~/roles
// roles/azure · privileged
Role Based Access Control AdministratorAzure built-in role
Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.
| Role ID | f58310d9-a9f6-439a-9e8d-f62e7b41a168 |
|---|---|
| Category | Privileged |
| Actions | 4 |
| Data actions | 0 |
Before you assign it
- It can give access to others. It allows
Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.
What it can do
| Permission | What it allows |
|---|---|
Microsoft.Authorization/roleAssignments/write | Create a role assignment at the specified scope. |
Microsoft.Authorization/roleAssignments/delete | Delete a role assignment at the specified scope. |
*/read | Every operation matching */read |
Microsoft.Support/* | Every operation under Microsoft.Support |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Role Based Access Control Administrator" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Role Based Access Control Administrator" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "f58310d9-a9f6-439a-9e8d-f62e7b41a168"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other privileged roles
- Contributor · 1 permission
- Owner · 1 permission
- User Access Administrator · 3 permissions
- Reservations Administrator · 7 permissions