Редагувати

Поділитися через


Examples to delegate Azure role assignment management with conditions

This article lists examples of how to delegate Azure role assignment management to other users with conditions.

Prerequisites

For information about the prerequisites to add or edit role assignment conditions, see Conditions prerequisites.

Example: Constrain roles

This condition allows a delegate to only add or remove role assignments for the Backup Contributor or Backup Reader roles.

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of role assignments constrained to Backup Contributor or Backup Reader roles.

Here are the settings to add this condition using the Azure portal and a condition template.

Condition Setting
Template Constrain roles
Roles Backup Contributor
Backup Reader

Example: Constrain roles and principal types

This condition allows a delegate to only add or remove role assignments for the Backup Contributor or Backup Reader roles. Also, the delegate can only assign these roles to principals of type user or group.

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of role assignments constrained Backup Contributor or Backup Reader roles and user or group principal types.

Here are the settings to add this condition using the Azure portal and a condition template.

Condition Setting
Template Constrain roles and principal types
Roles Backup Contributor
Backup Reader
Principal types Users
Groups

Example: Constrain roles and specific groups

This condition allows a delegate to only add or remove role assignments for the Backup Contributor or Backup Reader roles. Also, the delegate can only assign these roles to specific groups named Marketing (28c35fea-2099-4cf5-8ad9-473547bc9423) or Sales (86951b8b-723a-407b-a74a-1bca3f0c95d0).

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of role assignments constrained to Backup Contributor or Backup Reader roles and Marketing or Sales groups.

Here are the settings to add this condition using the Azure portal and a condition template.

Condition Setting
Template Constrain roles and principals
Roles Backup Contributor
Backup Reader
Principals Marketing
Sales

Example: Constrain virtual machine management

This condition allows a delegate to only add or remove role assignments for the Virtual Machine Administrator Login or Virtual Machine User Login roles. Also, the delegate can only assign these roles to a specific user named Dara (ea585310-c95c-4a68-af22-49af4363bbb1).

This condition is useful when you want to allow a delegate to assign a virtual machine login role to themselves for a virtual machine they've just created.

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of role assignments constrained to Virtual Machine Administrator Login or Virtual Machine User Login roles and a specific user.

Here are the settings to add this condition using the Azure portal and a condition template.

Condition Setting
Template Constrain roles and principals
Roles Virtual Machine Administrator Login
Virtual Machine User Login
Principals Dara

Example: Constrain AKS cluster management

This condition allows a delegate to only add or remove role assignments for the Azure Kubernetes Service RBAC Admin, Azure Kubernetes Service RBAC Cluster Admin, Azure Kubernetes Service RBAC Reader, or Azure Kubernetes Service RBAC Writer roles. Also, the delegate can only assign these roles to a specific user named Dara (ea585310-c95c-4a68-af22-49af4363bbb1).

This condition is useful when you want to allow a delegate to assign Azure Kubernetes Service (AKS) cluster data plane authorization roles to themselves for a cluster they've just created.

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of role assignments constrained to Azure Kubernetes Service RBAC Admin, Azure Kubernetes Service RBAC Cluster Admin, Azure Kubernetes Service RBAC Reader, or Azure Kubernetes Service RBAC Writer roles and a specific user.

Here are the settings to add this condition using the Azure portal and a condition template.

Example: Constrain ACR management

This condition allows a delegate to only add or remove role assignments for the AcrPull role. Also, the delegate can only assign these roles to principals of type service principal.

This condition is useful when you want to allow a developer to assign the AcrPull role to a managed identity themselves so that it can pull images from the Azure Container Registry (ACR).

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of role assignments constrained to the AcrPull role and service principal type.

Here are the settings to add this condition using the Azure portal and a condition template.

Condition Setting
Template Constrain roles and principal types
Roles AcrPull
Principal types Service principals

Example: Constrain add role assignments

This condition allows a delegate to only add role assignments for the Backup Contributor or Backup Reader roles. The delegate can remove any role assignments.

You must add this condition to any role assignments for the delegate that include the following action.

  • Microsoft.Authorization/roleAssignments/write

Diagram of add and remove role assignments constrained to Backup Contributor or Backup Reader roles.

None

Example: Allow most roles, but don't allow others to assign roles

This condition allows a delegate to add or remove role assignments for all roles except the Owner, Role Based Access Control Administrator, and User Access Administrator roles.

This condition is useful when you want to allow a delegate to assign most roles, but not allow the delegate to allow others to assign roles.

Note

This condition should be used with caution. If a new built-in or custom role is later added that includes the permission to create role assignments, this condition would not prevent the delegate from assigning roles. The condition would have to be updated to include the new built-in or custom role.

You must add this condition to any role assignments for the delegate that include the following actions.

  • Microsoft.Authorization/roleAssignments/write
  • Microsoft.Authorization/roleAssignments/delete

Diagram of add and remove role assignments for all roles except Owner, Role Based Access Control Administrator, and User Access Administrator.

Here are the settings to add this condition using the Azure portal and a condition template.

Condition Setting
Template Allow all except specific roles
Exclude roles Owner
Role Based Access Control Administrator
User Access Administrator

Next steps