Azure built-in roles · migration
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 3c9a5b7 · +338 −0 lines · also on GitHub
⋯ 573 unchanged lines
574574
}
575575
```
576576
577
+## Azure Local Migrate Execute Expert
578
+
579
+Grants restricted access on an Azure Local based Azure Migrate project to only perform migration related operations, including replication, execution of migrations, tracking and monitoring of migration progress, and initiation of agentless migrations.
580
+
581
+Includes an ABAC condition to constrain role assignments.
582
+
583
+[Learn more](/azure/migrate/prepare-azure-accounts)
584
+
585
+> [!div class="mx-tableFixed"]
586
+> | Actions | Description |
587
+> | --- | --- |
588
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
589
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
590
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
591
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |
592
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/locations/read | Gets the list of locations supported. |
593
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/checkResourceName/action | Check the resource name for validity. |
594
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
595
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/write | Creates or updates a deployment script |
596
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/read | Gets or lists deployment scripts |
597
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/write | Creates or updates a resource link. |
598
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
599
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/write | Add locks at the specified scope. |
600
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/delete | Delete locks at the specified scope. |
601
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
602
+> | [Microsoft.Migrate](../permissions/migration.md#microsoftmigrate)/*/read | |
603
+> | Microsoft.ApplicationMigration/*/read | |
604
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/*/read | |
605
+> | Microsoft.MySQLDiscovery/*/read | |
606
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
607
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/*/read | |
608
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/*/write | |
609
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/listKeys/action | Returns the access keys for the specified storage account. |
610
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/read | Gets or lists resource links. |
611
+> | Microsoft.DependencyMap/*/read | |
612
+> | Microsoft.DependencyMap/maps/*/action | |
613
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/*/Read | |
614
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/LogicalNetworks/join/action | Joins logical networks resource |
615
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/NetworkInterfaces/* | |
616
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/VirtualHardDisks/* | |
617
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/VirtualMachines/Write | Creates/Updates virtual machine resource |
618
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/VirtualMachineInstances/Write | Creates/Updates virtual machine instance resource |
619
+> | Microsoft.DataReplication/*/read | |
620
+> | Microsoft.DataReplication/replicationVaults/protectedItems/* | |
621
+> | Microsoft.DataReplication/replicationVaults/replicationExtensions/* | |
622
+> | Microsoft.DataReplication/replicationVaults/replicationPolicies/* | |
623
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/read | Gets an Custom Location resource |
624
+> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |
625
+> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/read | Gets an Appliance resource |
626
+> | **NotActions** | |
627
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/hypervSites/machines/inventoryinsights/pendingupdates/* | |
628
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/hypervSites/machines/inventoryinsights/vulnerabilities/* | |
629
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/serverSites/machines/inventoryinsights/pendingupdates/* | |
630
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/serverSites/machines/inventoryinsights/vulnerabilities/* | |
631
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/vmwareSites/machines/inventoryinsights/vulnerabilities/* | |
632
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/vmwareSites/machines/inventoryinsights/pendingupdates/* | |
633
+> | **DataActions** | |
634
+> | *none* | |
635
+> | **NotDataActions** | |
636
+> | *none* | |
637
+> | **Actions** | |
638
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
639
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
640
+> | **NotActions** | |
641
+> | *none* | |
642
+> | **DataActions** | |
643
+> | *none* | |
644
+> | **NotDataActions** | |
645
+> | *none* | |
646
+> | **Condition** | |
647
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) | Add or remove role assignments for the following roles:<br/>Storage Account Contributor<br/>Storage Blob Data Contributor |
648
+
649
+```json
650
+{
651
+ "assignableScopes": [
652
+ "/"
653
+ ],
654
+ "description": "Grants restricted access on an Azure Local based Azure Migrate project to only perform migration related operations, including replication, execution of migrations, tracking and monitoring of migration progress, and initiation of agentless migrations.",
655
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/1cfa4eac-9a23-481c-a793-bfb6958e836c",
656
+ "name": "1cfa4eac-9a23-481c-a793-bfb6958e836c",
657
+ "permissions": [
658
+ {
659
+ "actions": [
660
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
661
+ "Microsoft.Resources/subscriptions/read",
662
+ "Microsoft.Resources/deployments/*",
663
+ "Microsoft.Resources/subscriptions/resourceGroups/write",
664
+ "Microsoft.Resources/subscriptions/locations/read",
665
+ "Microsoft.Resources/checkResourceName/action",
666
+ "Microsoft.Resources/deployments/validate/action",
667
+ "Microsoft.Resources/deploymentScripts/write",
668
+ "Microsoft.Resources/deploymentScripts/read",
669
+ "Microsoft.Resources/links/write",
670
+ "Microsoft.Authorization/*/read",
671
+ "Microsoft.Authorization/locks/write",
672
+ "Microsoft.Authorization/locks/delete",
673
+ "Microsoft.Insights/alertRules/*",
674
+ "Microsoft.Migrate/*/read",
675
+ "Microsoft.ApplicationMigration/*/read",
676
+ "Microsoft.OffAzure/*/read",
677
+ "Microsoft.MySQLDiscovery/*/read",
678
+ "Microsoft.Support/*",
679
+ "Microsoft.Storage/storageAccounts/*/read",
680
+ "Microsoft.Storage/storageAccounts/*/write",
681
+ "Microsoft.Storage/storageAccounts/listKeys/action",
682
+ "Microsoft.Resources/links/read",
683
+ "Microsoft.DependencyMap/*/read",
684
+ "Microsoft.DependencyMap/maps/*/action",
685
+ "Microsoft.AzureStackHCI/*/Read",
686
+ "Microsoft.AzureStackHCI/LogicalNetworks/join/action",
687
+ "Microsoft.AzureStackHCI/NetworkInterfaces/*",
688
+ "Microsoft.AzureStackHCI/VirtualHardDisks/*",
689
+ "Microsoft.AzureStackHCI/VirtualMachines/Write",
690
+ "Microsoft.AzureStackHCI/VirtualMachineInstances/Write",
691
+ "Microsoft.DataReplication/*/read",
692
+ "Microsoft.DataReplication/replicationVaults/protectedItems/*",
693
+ "Microsoft.DataReplication/replicationVaults/replicationExtensions/*",
694
+ "Microsoft.DataReplication/replicationVaults/replicationPolicies/*",
695
+ "Microsoft.ExtendedLocation/customLocations/read",
696
+ "Microsoft.KubernetesConfiguration/extensions/read",
697
+ "Microsoft.ResourceConnector/appliances/read"
698
+ ],
699
+ "notActions": [
700
+ "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*",
701
+ "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*",
702
+ "Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*",
703
+ "Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*",
704
+ "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*",
705
+ "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*"
706
+ ],
707
+ "dataActions": [],
708
+ "notDataActions": []
709
+ },
710
+ {
711
+ "actions": [
712
+ "Microsoft.Authorization/roleAssignments/write",
713
+ "Microsoft.Authorization/roleAssignments/delete"
714
+ ],
715
+ "notActions": [],
716
+ "dataActions": [],
717
+ "notDataActions": [],
718
+ "conditionVersion": "2.0",
719
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe}))"
720
+ }
721
+ ],
722
+ "roleName": "Azure Local Migrate Execute Expert",
723
+ "roleType": "BuiltInRole",
724
+ "type": "Microsoft.Authorization/roleDefinitions"
725
+}
726
+```
727
+
728
+## Azure Local Migrate Owner
729
+
730
+Grants full access to create and manage Azure Local based Azure Migrate projects including appliance-based discovery and execution of migrations; Also grants ability to assign Azure Migrate Local specific roles in Azure RBAC
731
+
732
+Includes an ABAC condition to constrain role assignments.
733
+
734
+[Learn more](/azure/migrate/prepare-azure-accounts)
735
+
736
+> [!div class="mx-tableFixed"]
737
+> | Actions | Description |
738
+> | --- | --- |
739
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
740
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
741
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |
742
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
743
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/locations/read | Gets the list of locations supported. |
744
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/checkResourceName/action | Check the resource name for validity. |
745
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
746
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/write | Creates or updates a deployment script |
747
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/read | Gets or lists deployment scripts |
748
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/write | Creates or updates a resource link. |
749
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
750
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/write | Add locks at the specified scope. |
751
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/delete | Delete locks at the specified scope. |
752
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
753
+> | [Microsoft.Migrate](../permissions/migration.md#microsoftmigrate)/* | |
754
+> | Microsoft.ApplicationMigration/* | |
755
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/* | |
756
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
757
+> | Microsoft.MySQLDiscovery/* | |
758
+> | Microsoft.DependencyMap/* | |
759
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/* | |
760
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/checkNameAvailability/read | Checks that a key vault name is valid and is not in use |
761
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
762
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
763
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
764
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/register/action | Registers the subscription for the Microsoft.HybridCompute Resource Provider |
765
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
766
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |
767
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |
768
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/join/action | Joins a virtual network. Not Alertable. |
769
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/read | Gets an private endpoint resource. |
770
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/write | Creates a new private endpoint, or updates an existing private endpoint. |
771
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/privateDnsZoneGroups/write | Puts a Private DNS Zone Group |
772
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/write | Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone. |
773
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/virtualNetworkLinks/write | Create or update a Private DNS zone link to virtual network. |
774
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/join/action | Joins a Private DNS Zone |
775
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/A/write | Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set. |
776
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/register/action | Registers the subscription |
777
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
778
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/privateDnsZoneGroups/read | Gets a Private DNS Zone Group |
779
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/* | Create and manage storage accounts |
780
+> | [Microsoft.GuestConfiguration](../permissions/management-and-governance.md#microsoftguestconfiguration)/register/action | Registers the subscription for the Microsoft.GuestConfiguration resource provider. |
781
+> | [Microsoft.HybridConnectivity](../permissions/hybrid-multicloud.md#microsofthybridconnectivity)/register/action | Register the subscription for Microsoft.HybridConnectivity |
782
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/* | |
783
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/register/action | Registers subscription for given Resource Provider |
784
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/operations/read | Operation returns the list of Operations for a Resource Provider |
785
+> | Microsoft.DataReplication/*/read | |
786
+> | Microsoft.DataReplication/register/action | Registers the subscription for the Microsoft.DataReplication resource provider |
787
+> | Microsoft.DataReplication/replicationFabrics/* | |
788
+> | Microsoft.DataReplication/replicationVaults/* | |
789
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/register/action | Registers a subscription |
790
+> | Microsoft.AzureArcData/register/action | Register the subscription for Microsoft.AzureArcData |
791
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/read | Gets or lists resource links. |
792
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/*/Read | |
793
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/LogicalNetworks/join/action | Joins logical networks resource |
794
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/NetworkInterfaces/* | |
795
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/VirtualHardDisks/* | |
796
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/VirtualMachines/Write | Creates/Updates virtual machine resource |
797
+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/VirtualMachineInstances/Write | Creates/Updates virtual machine instance resource |
798
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/read | Gets an Custom Location resource |
799
+> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |
800
+> | [Microsoft.ResourceConnector](../permissions/hybrid-multicloud.md#microsoftresourceconnector)/appliances/read | Gets an Appliance resource |
801
+> | **NotActions** | |
802
+> | *none* | |
803
+> | **DataActions** | |
804
+> | *none* | |
805
+> | **NotDataActions** | |
806
+> | *none* | |
807
+> | **Actions** | |
808
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
809
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
810
+> | **NotActions** | |
811
+> | *none* | |
812
+> | **DataActions** | |
813
+> | *none* | |
814
+> | **NotDataActions** | |
815
+> | *none* | |
816
+> | **Condition** | |
817
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836c, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836c, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) | Add or remove role assignments for the following roles:<br/>Azure Migrate Decide and Plan Expert<br/>Azure Local Migrate Execute Expert<br/>Storage Account Contributor<br/>Storage Blob Data Contributor<br/>Azure Migrate Service Reader |
818
+
819
+```json
820
+{
821
+ "assignableScopes": [
822
+ "/"
823
+ ],
824
+ "description": "Grants full access to create and manage Azure Local based Azure Migrate projects including appliance-based discovery and execution of migrations; Also grants ability to assign Azure Migrate Local specific roles in Azure RBAC",
825
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/fd8ea4d5-6509-4db0-bada-356ab233b4fb",
826
+ "name": "fd8ea4d5-6509-4db0-bada-356ab233b4fb",
827
+ "permissions": [
828
+ {
829
+ "actions": [
830
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
831
+ "Microsoft.Resources/deployments/*",
832
+ "Microsoft.Resources/subscriptions/resourceGroups/write",
833
+ "Microsoft.Resources/subscriptions/read",
834
+ "Microsoft.Resources/subscriptions/locations/read",
835
+ "Microsoft.Resources/checkResourceName/action",
836
+ "Microsoft.Resources/deployments/validate/action",
837
+ "Microsoft.Resources/deploymentScripts/write",
838
+ "Microsoft.Resources/deploymentScripts/read",
839
+ "Microsoft.Resources/links/write",
840
+ "Microsoft.Authorization/*/read",
841
+ "Microsoft.Authorization/locks/write",
842
+ "Microsoft.Authorization/locks/delete",
843
+ "Microsoft.Insights/alertRules/*",
844
+ "Microsoft.Migrate/*",
845
+ "Microsoft.ApplicationMigration/*",
846
+ "Microsoft.OffAzure/*",
847
+ "Microsoft.Support/*",
848
+ "Microsoft.MySQLDiscovery/*",
849
+ "Microsoft.DependencyMap/*",
850
+ "Microsoft.KeyVault/vaults/*",
851
+ "Microsoft.KeyVault/checkNameAvailability/read",
852
+ "Microsoft.HybridCompute/machines/read",
853
+ "Microsoft.HybridCompute/machines/write",
854
+ "Microsoft.HybridCompute/machines/delete",
855
+ "Microsoft.HybridCompute/register/action",
856
+ "Microsoft.Network/virtualNetworks/read",
857
+ "Microsoft.Network/virtualNetworks/subnets/write",
858
+ "Microsoft.Network/virtualNetworks/subnets/join/action",
859
+ "Microsoft.Network/virtualNetworks/join/action",
860
+ "Microsoft.Network/privateEndpoints/read",
861
+ "Microsoft.Network/privateEndpoints/write",
862
+ "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
863
+ "Microsoft.Network/privateDnsZones/write",
864
+ "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
865
+ "Microsoft.Network/privateDnsZones/join/action",
866
+ "Microsoft.Network/privateDnsZones/A/write",
867
+ "Microsoft.Network/register/action",
868
+ "Microsoft.Network/virtualNetworks/subnets/read",
869
+ "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
870
+ "Microsoft.Storage/storageAccounts/*",
871
+ "Microsoft.GuestConfiguration/register/action",
872
+ "Microsoft.HybridConnectivity/register/action",
873
+ "Microsoft.RecoveryServices/vaults/*",
874
+ "Microsoft.RecoveryServices/register/action",
875
+ "Microsoft.RecoveryServices/operations/read",
876
+ "Microsoft.DataReplication/*/read",
877
+ "Microsoft.DataReplication/register/action",
878
+ "Microsoft.DataReplication/replicationFabrics/*",
879
+ "Microsoft.DataReplication/replicationVaults/*",
880
+ "Microsoft.KeyVault/register/action",
881
+ "Microsoft.AzureArcData/register/action",
882
+ "Microsoft.Resources/links/read",
883
+ "Microsoft.AzureStackHCI/*/Read",
884
+ "Microsoft.AzureStackHCI/LogicalNetworks/join/action",
885
+ "Microsoft.AzureStackHCI/NetworkInterfaces/*",
886
+ "Microsoft.AzureStackHCI/VirtualHardDisks/*",
887
+ "Microsoft.AzureStackHCI/VirtualMachines/Write",
888
+ "Microsoft.AzureStackHCI/VirtualMachineInstances/Write",
889
+ "Microsoft.ExtendedLocation/customLocations/read",
890
+ "Microsoft.KubernetesConfiguration/extensions/read",
891
+ "Microsoft.ResourceConnector/appliances/read"
892
+ ],
893
+ "notActions": [],
894
+ "dataActions": [],
895
+ "notDataActions": []
896
+ },
897
+ {
898
+ "actions": [
899
+ "Microsoft.Authorization/roleAssignments/write",
900
+ "Microsoft.Authorization/roleAssignments/delete"
901
+ ],
902
+ "notActions": [],
903
+ "dataActions": [],
904
+ "notDataActions": [],
905
+ "conditionVersion": "2.0",
906
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836c, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836c, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63}))"
907
+ }
908
+ ],
909
+ "roleName": "Azure Local Migrate Owner",
910
+ "roleType": "BuiltInRole",
911
+ "type": "Microsoft.Authorization/roleDefinitions"
912
+}
913
+```
914
+
577915
## Migrate Arc Discovery Reader - Preview
578916
579917
Read metadata of Azure Arc enabled server resources and metadata, performance and migration suitability of Arc enabled SQL server resources. Users creating Azure Migrate project that uses Arc resource discovery require this role on Arc scope of the project. To enable periodic sync, Azure Migrate project managed identity must be assigned this role. This role is in preview and subject to change.
⋯ 55 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.