← cd ~/roles
// roles/azure · management-and-governance
SRE Agent Standard UserAzure built-in role
Grants access to interact with the SRE Agent to triage incidents and run diagnostics.
| Role ID | 2d84a65a-63b2-4343-bbb6-31105d857bc1 |
|---|---|
| Category | Management-and-governance |
| Actions | 3 |
| Data actions | 10 |
Before you assign it
- It reaches the data, not just the resource. It has 10 data actions, such as reading blobs, secrets or messages.
What it can do
| Permission | What it allows |
|---|---|
Microsoft.Authorization/*/read | Any read operation on anything under Microsoft.Authorization |
Microsoft.Insights/alertRules/read | Read a classic metric alert |
Microsoft.App/agents/read | Read SRE Agent properties |
Data actions
| Permission | What it allows |
|---|---|
Microsoft.App/agents/threads/read | Read all the conversation threads with an SRE Agent |
Microsoft.App/agents/graph/read | Read resource graph in an SRE agent |
Microsoft.App/agents/memory/read | Read agent memory in an SRE agent |
Microsoft.App/agents/incidentManagement/read | Read incident management configurations in an SRE agent |
Microsoft.App/agents/threads/write | Create new conversation threads with an SRE Agent and reply to existing threads |
Microsoft.App/agents/graph/write | Update nodes in resource graph in an SRE agent |
Microsoft.App/agents/memory/write | Update agent memory in an SRE agent |
Microsoft.App/agents/scheduledtasks/read | Read scheduled tasks in an SRE agent |
Microsoft.App/agents/scheduledtasks/write | Update scheduled tasks in an SRE agent |
Microsoft.App/agents/scheduledtasks/delete | Delete existing scheduled tasks in an SRE agent |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "SRE Agent Standard User" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "SRE Agent Standard User" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, '2d84a65a-63b2-4343-bbb6-31105d857bc1')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2d84a65a-63b2-4343-bbb6-31105d857bc1')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "2d84a65a-63b2-4343-bbb6-31105d857bc1"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other management-and-governance roles
- Service Group Contributor · 1 permission
- Template Spec Reader · 1 permission
- Carbon Optimization Reader · 2 permissions
- Hierarchy Settings Administrator · 2 permissions
- Reservations Reader · 2 permissions
- Service Group Reader · 2 permissions
- Advisor Reviews Reader · 3 permissions
- Managed Application Operator Role · 3 permissions