I have Resource Group named RG1 with VM1, VM2, VM3 I have Resource Group named RG2 with Load Balancer LB1 Will I need network contributor role on both Resource Groups ?

Hello @Shridhar Srinivasan , I understand that you would like to know at what scope/s Network Contributor Role is needed to add backend VMs from one resource group to a Load Balancer in another resource group. I setup a lab and below are the roles that were needed to get this done: I have Resource Group named "LBRG" with Load Balancer "mylb-lb". I have Resource Group named "newrg" with a "VM". And, I added the below roles: Added Network Contributor Role on the load balancer resource group: The "Network Contributor" role on the LB resource group will provide the below permissions to manage the Load balancer and its backend: Added Network Contributor and Virtual Machine Contributor Roles on the Resource Group "newrg" where VM/VMs are deployed: The Network Contributor role on the resource group scope will allow the user to see and manage Microsoft.Network resources such as Vnets & NICs. At this point, the user will be able to add a backend pool to the load balancer but only with IP address option. If the user knows the IP address of the VM that needs to be added to the backend pool then yes, it will work. But if the user needs to use the NIC option to select the VMs in the backend pool, then it will not work. So, the user will need the Virtual Machine Contributor role as well on the Resource group. This is already explained in my other thread: https://learn.microsoft.com/en-us/answers/questions/1288486/network-contributor So, to conclude: You need the below roles: Resource Group named RG1 with VM1, VM2, VM3 - Both Network Contributor and Virtual Machine Contributor Roles on this RG. Resource Group named RG2 with Load Balancer LB1 - Network Contributor role on this RG. Kindly let us know if the above helps or you need further assistance on this issue. Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

At what scope/s Network Contributor Role is needed to add backend vms to a Load Balancer

Accepted answer

GitaraniSharma-MSFT 49,701 Reputation points Microsoft Employee

2023-07-31T15:48:03.5133333+00:00
Hello @Shridhar Srinivasan ,

I understand that you would like to know at what scope/s Network Contributor Role is needed to add backend VMs from one resource group to a Load Balancer in another resource group.

I setup a lab and below are the roles that were needed to get this done:

I have Resource Group named "LBRG" with Load Balancer "mylb-lb".

I have Resource Group named "newrg" with a "VM".

And, I added the below roles:

Added Network Contributor Role on the load balancer resource group:

The "Network Contributor" role on the LB resource group will provide the below permissions to manage the Load balancer and its backend:

Added Network Contributor and Virtual Machine Contributor Roles on the Resource Group "newrg" where VM/VMs are deployed:

The Network Contributor role on the resource group scope will allow the user to see and manage Microsoft.Network resources such as Vnets & NICs.

At this point, the user will be able to add a backend pool to the load balancer but only with IP address option. If the user knows the IP address of the VM that needs to be added to the backend pool then yes, it will work.

But if the user needs to use the NIC option to select the VMs in the backend pool, then it will not work. So, the user will need the Virtual Machine Contributor role as well on the Resource group.

This is already explained in my other thread: https://learn.microsoft.com/en-us/answers/questions/1288486/network-contributor

So, to conclude:

You need the below roles:

Resource Group named RG1 with VM1, VM2, VM3 - Both Network Contributor and Virtual Machine Contributor Roles on this RG.

Resource Group named RG2 with Load Balancer LB1 - Network Contributor role on this RG.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

4 people found this answer helpful.
Shridhar Srinivasan 220 Reputation points

2023-08-03T06:44:09.39+00:00

Thanks @GitaraniSharma-MSFT . I really appreciate the detailed responses you give. They are very helpful.

I need just one more little clarity. This section in your response - "The "Network Contributor" role on the LB will provide the below permissions to manage the Load balancer and it's backend:" - does not list anything about load balancing rules. Do I need explicit permissions for them also ?

GitaraniSharma-MSFT 49,701 Reputation points Microsoft Employee

2023-08-03T10:36:25.34+00:00

Hello @Shridhar Srinivasan , I just added few permissions in the list for your reference as the list is quite lengthy. But now I've added the complete list of load balancer network permissions that will come along with the "Network Contributor" role in my answer above.

I've also edited my answer to change the scope on Load balancer RG instead of adding the role on LB resource scope, as it could still limit the required permissions.

So, with the below roles, the user should be able to add backend VMs, create load balancing rules, NAT rules etc:

Resource Group named RG1 with VM1, VM2, VM3 - Both Network Contributor and Virtual Machine Contributor Roles on this RG.

Resource Group named RG2 with Load Balancer LB1 - Network Contributor role on this RG.

If you need to restrict the user from creating load balancing rules, NAT rules etc, you can also create a custom role and deny those specific actions from the Microsoft.Network resource provider operations.

Refer: https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftnetwork

https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-create

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Shridhar Srinivasan 220 Reputation points

2023-08-03T18:46:42.9733333+00:00

Many Thanks again for the proper explanation. I'll Accept the Answer and close this discussion.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

At what scope/s Network Contributor Role is needed to add backend vms to a Load Balancer

0 additional answers

Your answer