← cd ~/roles
// roles/azure · management-and-governance
SRE Agent AdministratorAzure built-in role
Full control of the agent—manage chats, incident response plans, and agent run modes; approve and execute commands.
| Role ID | e79298df-d852-4c6d-84f9-5d13249d1e55 |
|---|---|
| Category | Management-and-governance |
| Actions | 6 |
| Data actions | 4 |
Before you assign it
- It reaches the data, not just the resource. It has 4 data actions, such as reading blobs, secrets or messages.
What it can do
| Permission | What it allows |
|---|---|
Microsoft.Authorization/*/read | Any read operation on anything under Microsoft.Authorization |
Microsoft.Insights/alertRules/read | Read a classic metric alert |
Microsoft.App/agents/read | Read SRE Agent properties |
Microsoft.App/agents/*/read | Any read operation on anything under Microsoft.App/agents |
Microsoft.App/agents/write | Create or Update a SRE Agent |
Microsoft.App/agents/*/write | Any write operation on anything under Microsoft.App/agents |
Data actions
| Permission | What it allows |
|---|---|
Microsoft.App/agents/*/read | Any read operation on anything under Microsoft.App/agents |
Microsoft.App/agents/*/write | Any write operation on anything under Microsoft.App/agents |
Microsoft.App/agents/*/delete | Any delete operation on anything under Microsoft.App/agents |
Microsoft.App/agents/threads/approve/action | Approve action executions in conversation threads |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "SRE Agent Administrator" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "SRE Agent Administrator" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, 'e79298df-d852-4c6d-84f9-5d13249d1e55')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e79298df-d852-4c6d-84f9-5d13249d1e55')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "e79298df-d852-4c6d-84f9-5d13249d1e55"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other management-and-governance roles
- Service Group Contributor · 1 permission
- Template Spec Reader · 1 permission
- Carbon Optimization Reader · 2 permissions
- Hierarchy Settings Administrator · 2 permissions
- Reservations Reader · 2 permissions
- Service Group Reader · 2 permissions
- Advisor Reviews Reader · 3 permissions
- Managed Application Operator Role · 3 permissions