Edit

Prerequisites for Azure role assignment conditions

  • Article
  • 2 minutes to read

To add or edit Azure role assignment conditions, you must have the following prerequisites.

Storage accounts

For conditions that use blob index tags, you must use a storage account that is compatible with the blob index feature. For example, only General Purpose v2 (GPv2) storage accounts with hierarchical namespace (HNS) disabled are currently supported. For more information, see Manage and find Azure Blob data with blob index tags

Azure PowerShell

When using Azure PowerShell to add or update conditions, you must use the following versions:

Azure CLI

When using Azure CLI to add or update conditions, you must use the following versions:

REST API

When using the REST API to add or update conditions, you must use the following versions:

  • 2020-03-01-preview or later
  • 2020-04-01-preview or later if you want to utilize the description property for role assignments
  • 2022-04-01 is the first stable version

For more information, see API versions of Azure RBAC REST APIs.

Permissions

Just like role assignments, to add or update conditions, you must be signed in to Azure with a user that has the Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/roleAssignments/delete permissions, such as User Access Administrator or Owner.

Principal attributes

Important

Principal attributes are currently in PREVIEW. See the Supplemental Terms of Use for Microsoft Azure Previews for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

To use principal attributes (custom security attributes in Azure AD), you must have all of the following:

For more information about custom security attributes, see:

Next steps