// roles/azure · management-and-governance

Site Recovery ReaderAzure built-in role

Lets you view Site Recovery status but not perform other management operations

Role ID	`dbaa88c4-0c30-4179-9fb3-46319faa6149`
Category	Management-and-governance
Actions	32
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.RecoveryServices/locations/allocatedStamp/read`	GetAllocatedStamp is internal operation used by service
`Microsoft.RecoveryServices/Vaults/extendedInformation/read`	The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault?
`Microsoft.RecoveryServices/Vaults/monitoringAlerts/read`	Gets the alerts for the Recovery services vault.
`Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read`
`Microsoft.RecoveryServices/Vaults/read`	The Get Vault operation gets an object representing the Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/refreshContainers/read`
`Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read`	The Get Operation Results operation can be used get the operation status and result for the asynchronously submitted operation
`Microsoft.RecoveryServices/Vaults/registeredIdentities/read`	The Get Containers operation can be used get the containers registered for a resource.
`Microsoft.RecoveryServices/vaults/replicationAlertSettings/read`	Read any Alerts Settings
`Microsoft.RecoveryServices/vaults/replicationEvents/read`	Read any Events
`Microsoft.RecoveryServices/vaults/replicationFabrics/read`	Read any Fabrics
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read`	Read any Networks
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read`	Read any Network Mappings
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read`	Read any Protection Containers
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read`	Read any Protectable Items
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read`	Read any Protected Items
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read`	Read any Replication Recovery Points
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read`	Read any Protection Container Mappings
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read`	Read any Recovery Services Providers
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read`	Read any Storage Classifications
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read`	Read any Storage Classification Mappings
`Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read`	Read any vCenters
`Microsoft.RecoveryServices/vaults/replicationJobs/read`	Read any Jobs
`Microsoft.RecoveryServices/vaults/replicationPolicies/read`	Read any Policies
`Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read`	Read any Recovery Plans
`Microsoft.RecoveryServices/vaults/replicationVaultSettings/read`	Read any
`Microsoft.RecoveryServices/Vaults/storageConfig/read`
`Microsoft.RecoveryServices/Vaults/tokenInfo/read`
`Microsoft.RecoveryServices/Vaults/usages/read`	Returns usage details for a Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/vaultTokens/read`	The Vault Token operation can be used to get Vault Token for vault level backend operations.
`Microsoft.Support/*`	Every operation under Microsoft.Support

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Site Recovery Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Site Recovery Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'dbaa88c4-0c30-4179-9fb3-46319faa6149')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'dbaa88c4-0c30-4179-9fb3-46319faa6149')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "dbaa88c4-0c30-4179-9fb3-46319faa6149"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles