// roles/azure · management-and-governance

Site Recovery OperatorAzure built-in role

Lets you failover and failback but not perform other Site Recovery management operations

Role ID	`494ae006-db33-4328-bf46-533a6560a3ca`
Category	Management-and-governance
Actions	59
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.RecoveryServices/locations/allocatedStamp/read`	GetAllocatedStamp is internal operation used by service
`Microsoft.RecoveryServices/locations/allocateStamp/action`	AllocateStamp is internal operation used by service
`Microsoft.RecoveryServices/Vaults/extendedInformation/read`	The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault?
`Microsoft.RecoveryServices/Vaults/read`	The Get Vault operation gets an object representing the Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/refreshContainers/read`
`Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read`	The Get Operation Results operation can be used get the operation status and result for the asynchronously submitted operation
`Microsoft.RecoveryServices/Vaults/registeredIdentities/read`	The Get Containers operation can be used get the containers registered for a resource.
`Microsoft.RecoveryServices/vaults/replicationAlertSettings/read`	Read any Alerts Settings
`Microsoft.RecoveryServices/vaults/replicationEvents/read`	Read any Events
`Microsoft.RecoveryServices/vaults/replicationFabrics/checkConsistency/action`	Checks Consistency of the Fabric
`Microsoft.RecoveryServices/vaults/replicationFabrics/read`	Read any Fabrics
`Microsoft.RecoveryServices/vaults/replicationFabrics/reassociateGateway/action`	Reassociate Gateway
`Microsoft.RecoveryServices/vaults/replicationFabrics/renewcertificate/action`	Renew Certificate for Fabric
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read`	Read any Networks
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read`	Read any Network Mappings
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read`	Read any Protection Containers
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read`	Read any Protectable Items
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/applyRecoveryPoint/action`	Apply Recovery Point
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/failoverCommit/action`	Failover Commit
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/plannedFailover/action`	Planned Failover
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read`	Read any Protected Items
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read`	Read any Replication Recovery Points
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/repairReplication/action`	Repair replication
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/reProtect/action`	ReProtect Protected Item
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/switchprotection/action`	Switch Protection Container
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailover/action`	Test Failover
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailoverCleanup/action`	Test Failover Cleanup
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/unplannedFailover/action`	Failover
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/updateMobilityService/action`	Update Mobility Service
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read`	Read any Protection Container Mappings
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read`	Read any Recovery Services Providers
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/refreshProvider/action`	Refresh Provider
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read`	Read any Storage Classifications
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read`	Read any Storage Classification Mappings
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read`	Read any vCenters
`Microsoft.RecoveryServices/vaults/replicationJobs/*`	Every operation under Microsoft.RecoveryServices/vaults/replicationJobs
`Microsoft.RecoveryServices/vaults/replicationPolicies/read`	Read any Policies
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/failoverCommit/action`	Failover Commit Recovery Plan
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/plannedFailover/action`	Planned Failover Recovery Plan
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read`	Read any Recovery Plans
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/reProtect/action`	ReProtect Recovery Plan
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailover/action`	Test Failover Recovery Plan
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailoverCleanup/action`	Test Failover Cleanup Recovery Plan
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/unplannedFailover/action`	Failover Recovery Plan
`Microsoft.RecoveryServices/vaults/replicationVaultSettings/read`	Read any
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/*`	Every operation under Microsoft.RecoveryServices/Vaults/monitoringAlerts
`Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read`
`Microsoft.RecoveryServices/Vaults/storageConfig/read`
`Microsoft.RecoveryServices/Vaults/tokenInfo/read`
`Microsoft.RecoveryServices/Vaults/usages/read`	Returns usage details for a Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/vaultTokens/read`	The Vault Token operation can be used to get Vault Token for vault level backend operations.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Support/*`	Every operation under Microsoft.Support

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Site Recovery Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Site Recovery Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '494ae006-db33-4328-bf46-533a6560a3ca')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '494ae006-db33-4328-bf46-533a6560a3ca')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "494ae006-db33-4328-bf46-533a6560a3ca"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles