azureblog.co.uk
← cd ~/roles
// roles/azure · management-and-governance

Site Recovery ContributorAzure built-in role

Lets you manage Site Recovery service except vault creation and role assignment

Role ID6670b86e-a3f7-4917-ac9b-5d6ab1be4567
CategoryManagement-and-governance
Actions29
Data actions0

What it can do

PermissionWhat it allows
Microsoft.Authorization/*/readAny read operation on anything under Microsoft.Authorization
Microsoft.Insights/alertRules/*Every operation under Microsoft.Insights/alertRules
Microsoft.Network/virtualNetworks/readGet the virtual network definition
Microsoft.RecoveryServices/locations/allocatedStamp/readGetAllocatedStamp is internal operation used by service
Microsoft.RecoveryServices/locations/allocateStamp/actionAllocateStamp is internal operation used by service
Microsoft.RecoveryServices/Vaults/certificates/writeThe Update Resource Certificate operation updates the resource/vault credential certificate.
Microsoft.RecoveryServices/Vaults/extendedInformation/*Every operation under Microsoft.RecoveryServices/Vaults/extendedInformation
Microsoft.RecoveryServices/Vaults/readThe Get Vault operation gets an object representing the Azure resource of type 'vault'
Microsoft.RecoveryServices/Vaults/refreshContainers/read
Microsoft.RecoveryServices/Vaults/registeredIdentities/*Every operation under Microsoft.RecoveryServices/Vaults/registeredIdentities
Microsoft.RecoveryServices/vaults/replicationAlertSettings/*Every operation under Microsoft.RecoveryServices/vaults/replicationAlertSettings
Microsoft.RecoveryServices/vaults/replicationEvents/readRead any Events
Microsoft.RecoveryServices/vaults/replicationFabrics/*Every operation under Microsoft.RecoveryServices/vaults/replicationFabrics
Microsoft.RecoveryServices/vaults/replicationJobs/*Every operation under Microsoft.RecoveryServices/vaults/replicationJobs
Microsoft.RecoveryServices/vaults/replicationPolicies/*Every operation under Microsoft.RecoveryServices/vaults/replicationPolicies
Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/*Every operation under Microsoft.RecoveryServices/vaults/replicationRecoveryPlans
Microsoft.RecoveryServices/vaults/replicationVaultSettings/*Every operation under Microsoft.RecoveryServices/vaults/replicationVaultSettings
Microsoft.RecoveryServices/Vaults/storageConfig/*Every operation under Microsoft.RecoveryServices/Vaults/storageConfig
Microsoft.RecoveryServices/Vaults/tokenInfo/read
Microsoft.RecoveryServices/Vaults/usages/readReturns usage details for a Recovery Services Vault.
Microsoft.RecoveryServices/Vaults/vaultTokens/readThe Vault Token operation can be used to get Vault Token for vault level backend operations.
Microsoft.RecoveryServices/Vaults/monitoringAlerts/*Every operation under Microsoft.RecoveryServices/Vaults/monitoringAlerts
Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read
Microsoft.ResourceHealth/availabilityStatuses/readGets the availability statuses for all resources in the specified scope
Microsoft.Resources/deployments/*Every operation under Microsoft.Resources/deployments
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Storage/storageAccounts/readReturns the list of storage accounts or gets the properties for the specified storage account.
Microsoft.RecoveryServices/vaults/replicationOperationStatus/readRead any Vault Replication Operation Status
Microsoft.Support/*Every operation under Microsoft.Support

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Site Recovery Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Site Recovery Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '6670b86e-a3f7-4917-ac9b-5d6ab1be4567')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6670b86e-a3f7-4917-ac9b-5d6ab1be4567')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "6670b86e-a3f7-4917-ac9b-5d6ab1be4567"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Find the smallest role for a task →

Sources