Azure built-in roles · identity
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 9e024c2 · +399 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Azure built-in roles for Identity - Azure RBAC
3
+description: This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Identity category. It lists Actions, NotActions, DataActions, and NotDataActions.
4
+ms.service: role-based-access-control
5
+ms.topic: reference
6
+ms.workload: identity
7
+author: rolyon
8
+manager: amycolannino
9
+ms.author: rolyon
10
+ms.date: 02/07/2024
11
+ms.custom: generated
12
+---
13
+
14
+# Azure built-in roles for Identity
15
+
16
+This article lists the Azure built-in roles in the Identity category.
17
+
18
+
19
+## Domain Services Contributor
20
+
21
+Can manage Azure AD Domain Services and related network configurations
22
+
23
+[Learn more](/entra/identity/domain-services/tutorial-create-instance)
24
+
25
+> [!div class="mx-tableFixed"]
26
+> | Actions | Description |
27
+> | --- | --- |
28
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
29
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
30
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
31
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
32
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
33
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates an deployment. |
34
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
35
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
36
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
37
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
38
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
39
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
40
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
41
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
42
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
43
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
44
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
45
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
46
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/Logs/Read | Reading data from all your logs |
47
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/Metrics/Read | Read metrics |
48
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/DiagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |
49
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/DiagnosticSettingsCategories/Read | Read diagnostic settings categories |
50
+> | [Microsoft.AAD](../permissions/identity.md#microsoftaad)/register/action | Register Domain Service |
51
+> | [Microsoft.AAD](../permissions/identity.md#microsoftaad)/unregister/action | Unregister Domain Service |
52
+> | [Microsoft.AAD](../permissions/identity.md#microsoftaad)/domainServices/* | |
53
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/register/action | Registers the subscription |
54
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/unregister/action | Unregisters the subscription |
55
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
56
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/write | Creates a virtual network or updates an existing virtual network |
57
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/delete | Deletes a virtual network |
58
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/peer/action | Peers a virtual network with another virtual network |
59
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/join/action | Joins a virtual network. Not Alertable. |
60
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
61
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |
62
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/delete | Deletes a virtual network subnet |
63
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |
64
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/virtualNetworkPeerings/read | Gets a virtual network peering definition |
65
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/virtualNetworkPeerings/write | Creates a virtual network peering or updates an existing virtual network peering |
66
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/virtualNetworkPeerings/delete | Deletes a virtual network peering |
67
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read | Get the diagnostic settings of Virtual Network |
68
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read | Gets available metrics for the PingMesh |
69
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/azureFirewalls/read | Get Azure Firewall |
70
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/ddosProtectionPlans/read | Gets a DDoS Protection Plan |
71
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/ddosProtectionPlans/join/action | Joins a DDoS Protection Plan. Not alertable. |
72
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/read | Gets a load balancer definition |
73
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/delete | Deletes a load balancer |
74
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/*/read | |
75
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/backendAddressPools/join/action | Joins a load balancer backend address pool. Not Alertable. |
76
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/inboundNatRules/join/action | Joins a load balancer inbound nat rule. Not Alertable. |
77
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/natGateways/join/action | Joins a NAT Gateway |
78
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |
79
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/write | Creates a network interface or updates an existing network interface. |
80
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/delete | Deletes a network interface |
81
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/join/action | Joins a Virtual Machine to a network interface. Not Alertable. |
82
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/defaultSecurityRules/read | Gets a default security rule definition |
83
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/read | Gets a network security group definition |
84
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/write | Creates a network security group or updates an existing network security group |
85
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/delete | Deletes a network security group |
86
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
87
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/securityRules/read | Gets a security rule definition |
88
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/securityRules/write | Creates a security rule or updates an existing security rule |
89
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/securityRules/delete | Deletes a security rule |
90
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/read | Gets a route table definition |
91
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/write | Creates a route table or Updates an existing route table |
92
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/delete | Deletes a route table definition |
93
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/join/action | Joins a route table. Not Alertable. |
94
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/routes/read | Gets a route definition |
95
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/routes/write | Creates a route or Updates an existing route |
96
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/routes/delete | Deletes a route definition |
97
+> | **NotActions** | |
98
+> | *none* | |
99
+> | **DataActions** | |
100
+> | *none* | |
101
+> | **NotDataActions** | |
102
+> | *none* | |
103
+
104
+```json
105
+{
106
+ "assignableScopes": [
107
+ "/"
108
+ ],
109
+ "description": "Can manage Azure AD Domain Services and related network configurations",
110
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/eeaeda52-9324-47f6-8069-5d5bade478b2",
111
+ "name": "eeaeda52-9324-47f6-8069-5d5bade478b2",
112
+ "permissions": [
113
+ {
114
+ "actions": [
115
+ "Microsoft.Authorization/*/read",
116
+ "Microsoft.Resources/deployments/read",
117
+ "Microsoft.Resources/deployments/write",
118
+ "Microsoft.Resources/deployments/delete",
119
+ "Microsoft.Resources/deployments/cancel/action",
120
+ "Microsoft.Resources/deployments/validate/action",
121
+ "Microsoft.Resources/deployments/whatIf/action",
122
+ "Microsoft.Resources/deployments/exportTemplate/action",
123
+ "Microsoft.Resources/deployments/operations/read",
124
+ "Microsoft.Resources/deployments/operationstatuses/read",
125
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
126
+ "Microsoft.Insights/AlertRules/Write",
127
+ "Microsoft.Insights/AlertRules/Delete",
128
+ "Microsoft.Insights/AlertRules/Read",
129
+ "Microsoft.Insights/AlertRules/Activated/Action",
130
+ "Microsoft.Insights/AlertRules/Resolved/Action",
131
+ "Microsoft.Insights/AlertRules/Throttled/Action",
132
+ "Microsoft.Insights/AlertRules/Incidents/Read",
133
+ "Microsoft.Insights/Logs/Read",
134
+ "Microsoft.Insights/Metrics/Read",
135
+ "Microsoft.Insights/DiagnosticSettings/*",
136
+ "Microsoft.Insights/DiagnosticSettingsCategories/Read",
137
+ "Microsoft.AAD/register/action",
138
+ "Microsoft.AAD/unregister/action",
139
+ "Microsoft.AAD/domainServices/*",
140
+ "Microsoft.Network/register/action",
141
+ "Microsoft.Network/unregister/action",
142
+ "Microsoft.Network/virtualNetworks/read",
143
+ "Microsoft.Network/virtualNetworks/write",
144
+ "Microsoft.Network/virtualNetworks/delete",
145
+ "Microsoft.Network/virtualNetworks/peer/action",
146
+ "Microsoft.Network/virtualNetworks/join/action",
147
+ "Microsoft.Network/virtualNetworks/subnets/read",
148
+ "Microsoft.Network/virtualNetworks/subnets/write",
149
+ "Microsoft.Network/virtualNetworks/subnets/delete",
150
+ "Microsoft.Network/virtualNetworks/subnets/join/action",
151
+ "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
152
+ "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
153
+ "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
154
+ "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
155
+ "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
156
+ "Microsoft.Network/azureFirewalls/read",
157
+ "Microsoft.Network/ddosProtectionPlans/read",
158
+ "Microsoft.Network/ddosProtectionPlans/join/action",
159
+ "Microsoft.Network/loadBalancers/read",
160
+ "Microsoft.Network/loadBalancers/delete",
161
+ "Microsoft.Network/loadBalancers/*/read",
162
+ "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
163
+ "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
164
+ "Microsoft.Network/natGateways/join/action",
165
+ "Microsoft.Network/networkInterfaces/read",
166
+ "Microsoft.Network/networkInterfaces/write",
167
+ "Microsoft.Network/networkInterfaces/delete",
168
+ "Microsoft.Network/networkInterfaces/join/action",
169
+ "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
170
+ "Microsoft.Network/networkSecurityGroups/read",
171
+ "Microsoft.Network/networkSecurityGroups/write",
172
+ "Microsoft.Network/networkSecurityGroups/delete",
173
+ "Microsoft.Network/networkSecurityGroups/join/action",
174
+ "Microsoft.Network/networkSecurityGroups/securityRules/read",
175
+ "Microsoft.Network/networkSecurityGroups/securityRules/write",
176
+ "Microsoft.Network/networkSecurityGroups/securityRules/delete",
177
+ "Microsoft.Network/routeTables/read",
178
+ "Microsoft.Network/routeTables/write",
179
+ "Microsoft.Network/routeTables/delete",
180
+ "Microsoft.Network/routeTables/join/action",
181
+ "Microsoft.Network/routeTables/routes/read",
182
+ "Microsoft.Network/routeTables/routes/write",
183
+ "Microsoft.Network/routeTables/routes/delete"
184
+ ],
185
+ "notActions": [],
186
+ "dataActions": [],
187
+ "notDataActions": []
188
+ }
189
+ ],
190
+ "roleName": "Domain Services Contributor",
191
+ "roleType": "BuiltInRole",
192
+ "type": "Microsoft.Authorization/roleDefinitions"
193
+}
194
+```
195
+
196
+## Domain Services Reader
197
+
198
+Can view Azure AD Domain Services and related network configurations
199
+
200
+> [!div class="mx-tableFixed"]
201
+> | Actions | Description |
202
+> | --- | --- |
203
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
204
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
205
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
206
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
207
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
208
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
209
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
210
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/Logs/Read | Reading data from all your logs |
211
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/Metrics/read | Read metrics |
212
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/DiagnosticSettings/read | Read a resource diagnostic setting |
213
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/DiagnosticSettingsCategories/Read | Read diagnostic settings categories |
214
+> | [Microsoft.AAD](../permissions/identity.md#microsoftaad)/domainServices/*/read | |
215
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
216
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
217
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/virtualNetworkPeerings/read | Gets a virtual network peering definition |
218
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read | Get the diagnostic settings of Virtual Network |
219
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read | Gets available metrics for the PingMesh |
220
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/azureFirewalls/read | Get Azure Firewall |
221
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/ddosProtectionPlans/read | Gets a DDoS Protection Plan |
222
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/read | Gets a load balancer definition |
223
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/*/read | |
224
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/natGateways/read | Gets a Nat Gateway Definition |
225
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |
226
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/defaultSecurityRules/read | Gets a default security rule definition |
227
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/read | Gets a network security group definition |
228
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/securityRules/read | Gets a security rule definition |
229
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/read | Gets a route table definition |
230
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/routes/read | Gets a route definition |
231
+> | **NotActions** | |
232
+> | *none* | |
233
+> | **DataActions** | |
234
+> | *none* | |
235
+> | **NotDataActions** | |
236
+> | *none* | |
237
+
238
+```json
239
+{
240
+ "assignableScopes": [
241
+ "/"
242
+ ],
243
+ "description": "Can view Azure AD Domain Services and related network configurations",
244
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/361898ef-9ed1-48c2-849c-a832951106bb",
245
+ "name": "361898ef-9ed1-48c2-849c-a832951106bb",
246
+ "permissions": [
247
+ {
248
+ "actions": [
249
+ "Microsoft.Authorization/*/read",
250
+ "Microsoft.Resources/deployments/read",
251
+ "Microsoft.Resources/deployments/operations/read",
252
+ "Microsoft.Resources/deployments/operationstatuses/read",
253
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
254
+ "Microsoft.Insights/AlertRules/Read",
255
+ "Microsoft.Insights/AlertRules/Incidents/Read",
256
+ "Microsoft.Insights/Logs/Read",
257
+ "Microsoft.Insights/Metrics/read",
258
+ "Microsoft.Insights/DiagnosticSettings/read",
259
+ "Microsoft.Insights/DiagnosticSettingsCategories/Read",
260
+ "Microsoft.AAD/domainServices/*/read",
261
+ "Microsoft.Network/virtualNetworks/read",
262
+ "Microsoft.Network/virtualNetworks/subnets/read",
263
+ "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
264
+ "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
265
+ "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
266
+ "Microsoft.Network/azureFirewalls/read",
267
+ "Microsoft.Network/ddosProtectionPlans/read",
268
+ "Microsoft.Network/loadBalancers/read",
269
+ "Microsoft.Network/loadBalancers/*/read",
270
+ "Microsoft.Network/natGateways/read",
271
+ "Microsoft.Network/networkInterfaces/read",
272
+ "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
273
+ "Microsoft.Network/networkSecurityGroups/read",
274
+ "Microsoft.Network/networkSecurityGroups/securityRules/read",
275
+ "Microsoft.Network/routeTables/read",
276
+ "Microsoft.Network/routeTables/routes/read"
277
+ ],
278
+ "notActions": [],
279
+ "dataActions": [],
280
+ "notDataActions": []
281
+ }
282
+ ],
283
+ "roleName": "Domain Services Reader",
284
+ "roleType": "BuiltInRole",
285
+ "type": "Microsoft.Authorization/roleDefinitions"
286
+}
287
+```
288
+
289
+## Managed Identity Contributor
290
+
291
+Create, Read, Update, and Delete User Assigned Identity
292
+
293
+[Learn more](/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities)
294
+
295
+> [!div class="mx-tableFixed"]
296
+> | Actions | Description |
297
+> | --- | --- |
298
+> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/read | Gets an existing user assigned identity |
299
+> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/write | Creates a new user assigned identity or updates the tags associated with an existing user assigned identity |
300
+> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/delete | Deletes an existing user assigned identity |
301
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
302
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
303
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
304
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
305
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
306
+> | **NotActions** | |
307
+> | *none* | |
308
+> | **DataActions** | |
309
+> | *none* | |
310
+> | **NotDataActions** | |
311
+> | *none* | |
312
+
313
+```json
314
+{
315
+ "assignableScopes": [
316
+ "/"
317
+ ],
318
+ "description": "Create, Read, Update, and Delete User Assigned Identity",
319
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
320
+ "name": "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
321
+ "permissions": [
322
+ {
323
+ "actions": [
324
+ "Microsoft.ManagedIdentity/userAssignedIdentities/read",
325
+ "Microsoft.ManagedIdentity/userAssignedIdentities/write",
326
+ "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
327
+ "Microsoft.Authorization/*/read",
328
+ "Microsoft.Insights/alertRules/*",
329
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
330
+ "Microsoft.Resources/deployments/*",
331
+ "Microsoft.Support/*"
332
+ ],
333
+ "notActions": [],
334
+ "dataActions": [],
335
+ "notDataActions": []
336
+ }
337
+ ],
338
+ "roleName": "Managed Identity Contributor",
339
+ "roleType": "BuiltInRole",
340
+ "type": "Microsoft.Authorization/roleDefinitions"
341
+}
342
+```
343
+
344
+## Managed Identity Operator
345
+
346
+Read and Assign User Assigned Identity
347
+
348
+[Learn more](/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities)
349
+
350
+> [!div class="mx-tableFixed"]
351
+> | Actions | Description |
352
+> | --- | --- |
353
+> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/*/read | |
354
+> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/*/assign/action | |
355
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
356
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
357
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
358
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
359
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
360
+> | **NotActions** | |
361
+> | *none* | |
362
+> | **DataActions** | |
363
+> | *none* | |
364
+> | **NotDataActions** | |
365
+> | *none* | |
366
+
367
+```json
368
+{
369
+ "assignableScopes": [
370
+ "/"
371
+ ],
372
+ "description": "Read and Assign User Assigned Identity",
373
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f1a07417-d97a-45cb-824c-7a7467783830",
374
+ "name": "f1a07417-d97a-45cb-824c-7a7467783830",
375
+ "permissions": [
376
+ {
377
+ "actions": [
378
+ "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
379
+ "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
380
+ "Microsoft.Authorization/*/read",
381
+ "Microsoft.Insights/alertRules/*",
382
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
383
+ "Microsoft.Resources/deployments/*",
384
+ "Microsoft.Support/*"
385
+ ],
386
+ "notActions": [],
387
+ "dataActions": [],
388
+ "notDataActions": []
389
+ }
390
+ ],
391
+ "roleName": "Managed Identity Operator",
392
+ "roleType": "BuiltInRole",
393
+ "type": "Microsoft.Authorization/roleDefinitions"
394
+}
395
+```
396
+
397
+## Next steps
398
+
399
+- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 10:28 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.