Custom Synapse Role - subset of Synapse Contributor

Question

I am trying to create a custom role for a group of data engineers who only need to create, edit and delete notebooks. There is a Synapse role, Synapse Contributor, but I want to create a custom role for the following actions within a given workspace: "workspaces/notebooks/write, delete." In other words, I don't want to grant all of the other permissions that come with Synapse Contributor. Is this possible, and can you help me with the syntax?

I have tried numerous different formats, scopes, dataActions vs actions, etc. Thanks!

Answer 1

Thank you Amira Bedhiafi

Hello Jimmy Dobbins,

I see that the custom role "workspaces/notebooks/write, delete" (intended to extend the capabilities of Azure RBAC) exists in the document below, but this built-in role does not exist in the Azure portal.

This must be a bug. As Amira suggested, please log a support request

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-synapse-rbac-roles

Answer 2

In your case the actions you've identified, "workspaces/notebooks/write" and "delete," would be part of the dataActions in the role definition. It's important to note that "edit" and "create" actions can be covered by the "write" permission, and "delete" is explicitly mentioned.

{

  "Name": "Custom Synapse Notebooks Contributor",

  "IsCustom": true,

  "Description": "Can create, edit, and delete notebooks in Synapse workspace.",

  "Actions": [],

  "NotActions": [],

  "DataActions": [

    "Microsoft.Synapse/workspaces/notebooks/write",

    "Microsoft.Synapse/workspaces/notebooks/delete"

  ],

  "NotDataActions": [],

  "AssignableScopes": ["/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Synapse/workspaces/{workspace-name}"]

}

Focus on these properties

• IsCustom: to indicate that this is a custom role
• DataActions: This is where you define permissions for notebook operations
• AssignableScopes: Here you specify where this role can be assigned. You should replace the placeholders with your subscription ID, resource group, and workspace name.

Then, save the JSON definition to a file and use the Azure CLI to create the role definition:

az role definition create --role-definition @customRoleDefinition.json