What permission or role is necessary to access Iot Devices and Query explorers in Azure Iot Hub ?

Question

In Azure IoT-Hub (portal), IoT devices and Query explorers are not accessible to users who do not have at least the contributor role. There does not seem to be a built-in role to access these explorers so I would like to create a custom role : basically a Reader with additional permission to see the explorers.

However I can't find wichi authorizations / permissions are needed to see the Iot Device explorer and the Query explorer. Anyone knows where I can find that ?

Answer 1

@Alexandre

You can set the masterreader access which allows a user to view everything but not make changes.

Access control (IAM) is the page that you typically use to assign roles to grant access to Azure resources. It's also known as identity and access management and appears in several locations in the Azure portal.

To grant access to an Azure resource, you add a role assignment. Follow these steps to assign a role.

• Click on the specific resource you want to provide access.
• Click Access control (IAM).
• Click the Role assignments tab to add/view the role assignments at this scope.
• Select masterreader.
• Specify the user details to add.

Please refer Add or remove Azure role assignments using the Azure portal for more details.

If the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.

Please see Create or update Azure custom roles using the Azure portal for more details.

Hope that helps. Do let us know if you have further queries.

Please accept helpful responses as 'Answer', which will be helpful to others as well.

Answer 2

Hi
You have not mentioned what permissions to add to this custom role, pls list the permissions to add thanks.

Answer 3

@Alexandre
To receive notifications when answer is posted on the question you have asked or you follow, click on your Avatar, and then Settings. Make sure you have an email for notifications. Then, on Q&A email notifications section, select Questions in tags you follow and click on Save.

Regarding the specific question, as mentioned earlier, this role Allows a user to view everything but not make changes.

To add or remove role assignments, you must have:

Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/roleAssignments/delete permissions, such as User Access Administrator or Owner

Kindly check Add or remove Azure role assignments using the Azure portal for more details.

Please accept helpful responses as 'Answer' and 'Up vote' which will be helpful to others as well.