← cd ~/roles
// roles/azure · management-and-governance
SRE Agent ReaderAzure built-in role
Grants read-only access to all SRE Agent data, including chats, incidents, logs, and configurations. Does not permit interaction with the agent.
| Role ID | a4b156ac-253f-4a1a-9851-96d62b71b047 |
|---|---|
| Category | Management-and-governance |
| Actions | 3 |
| Data actions | 4 |
Before you assign it
- It reaches the data, not just the resource. It has 4 data actions, such as reading blobs, secrets or messages.
What it can do
| Permission | What it allows |
|---|---|
Microsoft.Authorization/*/read | Any read operation on anything under Microsoft.Authorization |
Microsoft.Insights/alertRules/* | Every operation under Microsoft.Insights/alertRules |
Microsoft.App/agents/read | Read SRE Agent properties |
Data actions
| Permission | What it allows |
|---|---|
Microsoft.App/agents/threads/read | Read all the conversation threads with an SRE Agent |
Microsoft.App/agents/graph/read | Read resource graph in an SRE agent |
Microsoft.App/agents/memory/read | Read agent memory in an SRE agent |
Microsoft.App/agents/incidentManagement/read | Read incident management configurations in an SRE agent |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "SRE Agent Reader" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "SRE Agent Reader" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, 'a4b156ac-253f-4a1a-9851-96d62b71b047')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4b156ac-253f-4a1a-9851-96d62b71b047')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "a4b156ac-253f-4a1a-9851-96d62b71b047"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other management-and-governance roles
- Service Group Contributor · 1 permission
- Template Spec Reader · 1 permission
- Carbon Optimization Reader · 2 permissions
- Hierarchy Settings Administrator · 2 permissions
- Reservations Reader · 2 permissions
- Service Group Reader · 2 permissions
- Advisor Reviews Reader · 3 permissions
- Managed Application Operator Role · 3 permissions