Azure built-in roles · migration

This page's changes and edits · All guidance changes

Microsoft's edit · 2 Jan 20:14 UTC

Azure Migrate Service Reader role

Microsoft's commit message in MicrosoftDocs/azure-docs · commit 15bbba9 · +67 −2 lines · also on GitHub

⋯ 160 unchanged lines

161161

162162 Grants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.

163163

164 +Includes an ABAC condition to constrain role assignments.

165 +

164166 [Learn more](/azure/migrate/prepare-azure-accounts)

165167

166168 > [!div class="mx-tableFixed"]

⋯ 63 unchanged lines

230232 > | **NotDataActions** | |

231233 > | *none* | |

232234 > | **Condition** | |

233 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) | |

235 +> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) | Add or remove role assignments for the following roles: Storage Account Contributor Storage Blob Data Contributor |

234236

235237 ```json

236238 {

⋯ 83 unchanged lines

320322

321323 Grants full access to create and manage Azure Migrate projects including appliance-based discovery, creation of business case & assessment report and execution of migrations; Also grants ability to assign Azure Migrate specific roles in Azure RBAC.

322324

325 +Includes an ABAC condition to constrain role assignments.

326 +

323327 [Learn more](/azure/migrate/prepare-azure-accounts)

324328

325329 > [!div class="mx-tableFixed"]

⋯ 81 unchanged lines

407411 > | **NotDataActions** | |

408412 > | *none* | |

409413 > | **Condition** | |

410 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) | |

414 +> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) | Add or remove role assignments for the following roles: Azure Migrate Decide and Plan Expert Azure Migrate Execute Expert Storage Account Contributor Storage Blob Data Contributor Azure Migrate Service Reader |

411415

412416 ```json

413417 {

⋯ 90 unchanged lines

504508 }

505509 ],

506510 "roleName": "Azure Migrate Owner",

511 + "roleType": "BuiltInRole",

512 + "type": "Microsoft.Authorization/roleDefinitions"

513 +}

514 +```

515 +

516 +## Azure Migrate Service Reader

517 +

518 +Grants required access to the system assigned managed identity of Azure Migrate project resource.

519 +

520 +[Learn more](/azure/migrate/prepare-azure-accounts)

521 +

522 +> [!div class="mx-tableFixed"]

523 +> | Actions | Description |

524 +> | --- | --- |

525 +> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

526 +> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

527 +> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

528 +> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

529 +> | Microsoft.ApplicationMigration/*/read | |

530 +> | [Microsoft.Migrate](../permissions/migration.md#microsoftmigrate)/*/read | |

531 +> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/*/read | |

532 +> | Microsoft.MySQLDiscovery/*/read | |

533 +> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read | Read any Protectable Items |

534 +> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read | Read any Protected Items |

535 +> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/replicationFabrics/replicationProtectionContainers/replicationMigrationItems/read | Read any Migration Items |

536 +> | **NotActions** | |

537 +> | *none* | |

538 +> | **DataActions** | |

539 +> | *none* | |

540 +> | **NotDataActions** | |

541 +> | *none* | |

542 +

543 +```json

544 +{

545 + "assignableScopes": [

546 + "/"

547 + ],

548 + "description": "Grants required access to the system assigned managed identity of Azure Migrate project resource.",

549 + "id": "/providers/Microsoft.Authorization/roleDefinitions/ba480ccd-6499-4709-b581-8f38bb215c63",

550 + "name": "ba480ccd-6499-4709-b581-8f38bb215c63",

551 + "permissions": [

552 + {

553 + "actions": [

554 + "Microsoft.Resources/subscriptions/resourceGroups/read",

555 + "Microsoft.Authorization/*/read",

556 + "Microsoft.Insights/alertRules/*",

557 + "Microsoft.Resources/deployments/*",

558 + "Microsoft.ApplicationMigration/*/read",

559 + "Microsoft.Migrate/*/read",

560 + "Microsoft.OffAzure/*/read",

561 + "Microsoft.MySQLDiscovery/*/read",

562 + "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",

563 + "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",

564 + "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationMigrationItems/read"

565 + ],

566 + "notActions": [],

567 + "dataActions": [],

568 + "notDataActions": []

569 + }

570 + ],

571 + "roleName": "Azure Migrate Service Reader",

507572 "roleType": "BuiltInRole",

508573 "type": "Microsoft.Authorization/roleDefinitions"

509574 }

⋯ 5 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.