Allow users to create and cancel pipeline runs for a particular pipeline in ADF

Vanya Strelchenko 51

I need to grant a group of users access to execute, monitor, and cancel pipeline runs of a particular pipeline. I have created a custom role defined below. While the role allows users to create pipeline runs, it does not allow them to cancel those runs. I am not sure what I am doing wrong here.

  {  
    "properties": {  
         "roleName": "Pipeline Operator",  
         "description": "This allows to run this DF pipeline - factories/

KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-08-11T02:06:57.007+00:00

Hello @Vanya Strelchenko ,

Thanks for the question and using MS Q&A platform.

As per my understanding you are trying to create custom role so that a user with that role should be able to trigger run and also should be able to cancel run for a particular pipeline, please correct me if my understanding is not accurate.

For create trigger run a particular pipeline you will have to have a custom role with below scope and permissions:

But in order to cancel a pipeline run using the action: 'Microsoft.DataFactory/factories/pipelineruns/cancel/action' or Microsoft.DataFactory/factories/cancelpipelinerun/action, you will have to create another custom role with a different scope - "/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.DataFactory/factories/<factory_name>/pipelineruns/<pipelinerunID>" as the as those actions are intended to Cancel the pipeline run specified by the run ID.

I'm playing around the scope with various combinations to be able to cancel runs of particular pipeline, but not luck. I tried with scope "/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.DataFactory/factories/<factory_name>/pipelineruns" but this will give access to cancel runs for all the pipeline of a factory since there is no runID mentioned. Which is not the use case in your requirement.
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-08-11T02:07:44.543+00:00

<<Continuation to above comment>>

I'll continue to research more on this and will get back to you as soon as I have a solution for it.

Thank you for your patience.
Vanya Strelchenko 51 Reputation points

2022-08-11T15:13:48.787+00:00

Thanks for your work on this @KranthiPakala-MSFT ! Yes, you understood the problem correctly. As I mentioned in my question, the issue is not with giving a user permissions to trigger a particular pipeline, but rather allowing the same user to cancel it when needed. While it is good to know that you can do that by specifying pipelineRunId in the scope, I do not want to have to modify permissions every time a new pipelineRunId is generated. I also do not want to give access to a user to cancel any pipeline in ADF. There just has to be a better way of doing that.
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-08-30T18:58:01.517+00:00

Hello @Vanya Strelchenko ,

Just wanted to update you that I have reached out to respective product team to check if there is a way to give permission to only cancel the runs of a particular pipelines. As per my analysis I don't a way to achieve it as 'Microsoft.DataFactory/factories/pipelineruns/cancel/action will give permission to cancel runs of any pipeline in that data factory based in a run ID but not on a pipeline name.

It seems to be a new feature request but let us wait for a confirmation from product team. Will keep this thread posted as soon as we hear back from them.

Thank you for your patience

Accepted answer

KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-09-30T16:48:46.577+00:00

Hello @Vanya Strelchenko ,

Just wanted to update you: Currently there is no way to grant a user to only cancel a particular permission. This could be a new feature request. I would recommend submitting a feature request in IDEAS forum here. https://feedback.azure.com/d365community/forum/1219ec2d-6c26-ec11-b6e6-000d3a4f032c

Please do share the URL once the feedback is logged so that I shall up-vote on it and also will pass the feedback link to respective product owners to further review it.

Thank you
Please sign in to rate this answer.
Vanya Strelchenko 51 Reputation points

2022-10-13T17:05:24.83+00:00

Thanks, @KranthiPakala-MSFT ! I have created a new feature request here https://feedback.azure.com/d365community/idea/5ba385fa-184b-ed11-a81b-000d3adfeb99.

KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-10-14T16:58:41.28+00:00

Hello @Vanya Strelchenko ,

Appreciate much for logging the feedback and sharing the URL here. I have up voted your feedback. :)
Sign in to comment

Allow users to create and cancel pipeline runs for a particular pipeline in ADF

0 additional answers