Peran bawaan Azure untuk Identitas

Artikel
04/30/2024

Artikel ini mencantumkan peran bawaan Azure dalam kategori Identitas.

Kontributor Layanan Domain

Dapat mengelola Azure AD Domain Services dan konfigurasi jaringan terkait

Tindakan	Deskripsi
Microsoft.Authorization/*/baca	Membaca peran dan penetapan peran
Microsoft.Resources/penyebaran/baca	Mendapatkan atau mencantumkan penyebaran.
Microsoft.Resources/penyebaran/tulis	Membuat atau memperbarui penyebaran.
Microsoft.Resources/deployments/delete	Menghapus penyebaran.
Microsoft.Resources/deployments/cancel/action	Membatalkan penyebaran.
Microsoft.Resources/deployments/validate/action	Memvalidasi penyebaran.
Microsoft.Resources/deployments/whatIf/action	Memprediksi perubahan penyebaran templat.
Microsoft.Resources/deployments/exportTemplate/action	Mengekspor templat untuk penyebaran
Microsoft.Resources/penyebaran/operasi/baca	Mendapatkan atau mencantumkan operasi penyebaran.
Microsoft.Resources/deployments/operationstatuses/read	Mendapatkan atau mencantumkan status operasi penyebaran.
Microsoft.Resources/langganan/resourceGroups/baca	Mendapatkan atau mencantumkan grup sumber daya.
Microsoft.Insights/AlertRules/Write	Membuat atau memperbarui pemberitahuan metrik klasik
Microsoft.Insights/AlertRules/Delete	Menghapus pemberitahuan metrik klasik
Microsoft.Insights/AlertRules/Read	Membaca pemberitahuan metrik klasik
Microsoft.Insights/AlertRules/Activated/Action	Pemberitahuan metrik klasik diaktifkan
Microsoft.Insights/AlertRules/Resolved/Action	Pemberitahuan metrik klasik diselesaikan
Microsoft.Insights/AlertRules/Throttled/Action	Aturan pemberitahuan metrik klasik dibatasi
Microsoft.Insights/AlertRules/Incidents/Read	Membaca insiden pemberitahuan metrik klasik
Microsoft.Insights/Logs/Read	Membaca data dari semua log Anda
Microsoft.Insights/Metrics/Read	Membaca metrik
Microsoft.Insights/DiagnosticSettings/*	Membuat, memperbarui, atau membaca pengaturan diagnostik untuk Server Analisis
Microsoft.Insights/Diagnostic Pengaturan Categories/Read	Membaca kategori pengaturan diagnostik
Microsoft.AAD/register/action	Mendaftarkan Layanan Domain
Microsoft.AAD/unregister/action	Membatalkan pendaftaran Layanan Domain
Microsoft.AAD/domainServices/*
Microsoft.Network/register/action	Mendaftarkan langganan
Microsoft.Network/unregister/action	Membatalkan pendaftaran langganan
Microsoft.Network/virtualNetworks/baca	Dapatkan definisi jaringan virtual
Microsoft.Network/virtualNetworks/write	Membuat jaringan virtual atau memperbarui jaringan virtual yang ada
Microsoft.Network/virtualNetworks/delete	Menghapus jaringan virtual
Microsoft.Network/virtualNetworks/peer/action	Sandingkan jaringan virtual dengan jaringan virtual lain
Microsoft.Network/virtualNetworks/gabung/tindakan	Bergabung dengan jaringan virtual. Tidak bisa diperingatkan.
Microsoft.Network/virtualNetworks/subnets/baca	Mendapatkan definisi subnet jaringan virtual
Microsoft.Network/virtualNetworks/subnets/write	Membuat subnet jaringan virtual atau memperbarui subnet jaringan virtual yang ada
Microsoft.Network/virtualNetworks/subnets/delete	Menghapus subnet jaringan virtual
Microsoft.Network/virtualNetworks/subnets/gabung/tindakan	Bergabung dengan jaringan virtual. Tidak bisa diperingatkan.
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read	Mendapat definisi peering jaringan virtual
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write	Membuat peering jaringan virtual atau memperbarui peering jaringan virtual yang ada
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete	Menghapus peering jaringan virtual
Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnostic Pengaturan/read	Dapatkan pengaturan diagnostik Microsoft Azure Virtual Network
Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read	Mendapatkan metrik yang tersedia untuk PingMesh
Microsoft.Network/azureFirewalls/read	Mendapatkan Azure Firewall
Microsoft.Network/ddosProtectionPlans/read	Mendapatkan Paket Azure DDoS Protection
Microsoft.Network/ddosProtectionPlans/join/action	Menggabungkan Paket Azure DDoS Protection. Tidak dapat diberi tahu.
Microsoft.Network/loadBalancers/baca	Mendapatkan definisi penyeimbang muatan
Microsoft.Network/loadBalancers/delete	Menghapus penyeimbang beban
Microsoft.Network/loadBalancers/*/read
Microsoft.Network/loadBalancers/backendAddressPools/gabung/tindakan	Menggabungkan kumpulan alamat ujung belakang penyeimbang muatan. Tidak bisa diperingatkan.
Microsoft.Network/loadBalancers/inboundNatRules/gabung/tindakan	Bergabung dengan kumpulan NAT masuk penyeimbang muatan. Tidak bisa diperingatkan.
Microsoft.Network/natGateways/join/action	Menggabungkan NAT Gateway
Microsoft.Network/networkInterfaces/baca	Mendapatkan definisi antarmuka jaringan.
Microsoft.Network/networkInterfaces/tulis	Membuat antarmuka jaringan atau memperbarui antarmuka jaringan yang ada.
Microsoft.Network/networkInterfaces/delete	Menghapus antarmuka jaringan
Microsoft.Network/networkInterfaces/gabung/tindakan	Melampirkan antarmuka jaringan ke komputer virtual. Tidak bisa diperingatkan.
Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read	Mendapatkan definisi aturan keamanan default
Microsoft.Network/networkSecurityGroups/baca	Mendapatkan definisi kelompok keamanan jaringan
Microsoft.Network/networkSecurityGroups/write	Membuat kelompok keamanan jaringan atau memperbarui kelompok keamanan jaringan yang ada
Microsoft.Network/networkSecurityGroups/delete	Menghapus kelompok keamanan jaringan
Microsoft.Network/networkSecurityGroups/gabung/tindakan	Menggabungkan kelompok keamanan jaringan. Tidak bisa diperingatkan.
Microsoft.Network/networkSecurityGroups/securityRules/read	Mendapatkan definisi aturan keamanan
Microsoft.Network/networkSecurityGroups/securityRules/write	Membuat aturan keamanan atau memperbarui aturan keamanan yang sudah ada
Microsoft.Network/networkSecurityGroups/securityRules/delete	Menghapus aturan keamanan
Microsoft.Network/routeTables/read	Mendapat definisi tabel rute
Microsoft.Network/routeTables/write	Membuat tabel rute atau Memperbarui tabel rute yang ada
Microsoft.Network/routeTables/delete	Menghapus definisi tabel rute
Microsoft.Network/routeTables/join/action	Menggabungkan tabel rute. Tidak bisa diperingatkan.
Microsoft.Network/routeTables/routes/read	Mendapat definisi rute
Microsoft.Network/routeTables/routes/write	Membuat rute atau Memperbarui rute yang ada
Microsoft.Network/routeTables/routes/delete	Menghapus definisi rute
NotActions
Tidak ada
DataActions
Tidak ada
NotDataActions
Tidak ada

{
  "assignableScopes": [
    "/"
  ],
  "description": "Can manage Azure AD Domain Services and related network configurations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/eeaeda52-9324-47f6-8069-5d5bade478b2",
  "name": "eeaeda52-9324-47f6-8069-5d5bade478b2",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/read",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/deployments/delete",
        "Microsoft.Resources/deployments/cancel/action",
        "Microsoft.Resources/deployments/validate/action",
        "Microsoft.Resources/deployments/whatIf/action",
        "Microsoft.Resources/deployments/exportTemplate/action",
        "Microsoft.Resources/deployments/operations/read",
        "Microsoft.Resources/deployments/operationstatuses/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Insights/AlertRules/Write",
        "Microsoft.Insights/AlertRules/Delete",
        "Microsoft.Insights/AlertRules/Read",
        "Microsoft.Insights/AlertRules/Activated/Action",
        "Microsoft.Insights/AlertRules/Resolved/Action",
        "Microsoft.Insights/AlertRules/Throttled/Action",
        "Microsoft.Insights/AlertRules/Incidents/Read",
        "Microsoft.Insights/Logs/Read",
        "Microsoft.Insights/Metrics/Read",
        "Microsoft.Insights/DiagnosticSettings/*",
        "Microsoft.Insights/DiagnosticSettingsCategories/Read",
        "Microsoft.AAD/register/action",
        "Microsoft.AAD/unregister/action",
        "Microsoft.AAD/domainServices/*",
        "Microsoft.Network/register/action",
        "Microsoft.Network/unregister/action",
        "Microsoft.Network/virtualNetworks/read",
        "Microsoft.Network/virtualNetworks/write",
        "Microsoft.Network/virtualNetworks/delete",
        "Microsoft.Network/virtualNetworks/peer/action",
        "Microsoft.Network/virtualNetworks/join/action",
        "Microsoft.Network/virtualNetworks/subnets/read",
        "Microsoft.Network/virtualNetworks/subnets/write",
        "Microsoft.Network/virtualNetworks/subnets/delete",
        "Microsoft.Network/virtualNetworks/subnets/join/action",
        "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
        "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
        "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
        "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
        "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Network/azureFirewalls/read",
        "Microsoft.Network/ddosProtectionPlans/read",
        "Microsoft.Network/ddosProtectionPlans/join/action",
        "Microsoft.Network/loadBalancers/read",
        "Microsoft.Network/loadBalancers/delete",
        "Microsoft.Network/loadBalancers/*/read",
        "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
        "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
        "Microsoft.Network/natGateways/join/action",
        "Microsoft.Network/networkInterfaces/read",
        "Microsoft.Network/networkInterfaces/write",
        "Microsoft.Network/networkInterfaces/delete",
        "Microsoft.Network/networkInterfaces/join/action",
        "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
        "Microsoft.Network/networkSecurityGroups/read",
        "Microsoft.Network/networkSecurityGroups/write",
        "Microsoft.Network/networkSecurityGroups/delete",
        "Microsoft.Network/networkSecurityGroups/join/action",
        "Microsoft.Network/networkSecurityGroups/securityRules/read",
        "Microsoft.Network/networkSecurityGroups/securityRules/write",
        "Microsoft.Network/networkSecurityGroups/securityRules/delete",
        "Microsoft.Network/routeTables/read",
        "Microsoft.Network/routeTables/write",
        "Microsoft.Network/routeTables/delete",
        "Microsoft.Network/routeTables/join/action",
        "Microsoft.Network/routeTables/routes/read",
        "Microsoft.Network/routeTables/routes/write",
        "Microsoft.Network/routeTables/routes/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Domain Services Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Pembaca Layanan Domain

Dapat melihat Azure AD Domain Services dan konfigurasi jaringan terkait

Tindakan	Deskripsi
Microsoft.Authorization/*/baca	Membaca peran dan penetapan peran
Microsoft.Resources/penyebaran/baca	Mendapatkan atau mencantumkan penyebaran.
Microsoft.Resources/penyebaran/operasi/baca	Mendapatkan atau mencantumkan operasi penyebaran.
Microsoft.Resources/deployments/operationstatuses/read	Mendapatkan atau mencantumkan status operasi penyebaran.
Microsoft.Resources/langganan/resourceGroups/baca	Mendapatkan atau mencantumkan grup sumber daya.
Microsoft.Insights/AlertRules/Read	Membaca pemberitahuan metrik klasik
Microsoft.Insights/AlertRules/Incidents/Read	Membaca insiden pemberitahuan metrik klasik
Microsoft.Insights/Logs/Read	Membaca data dari semua log Anda
Microsoft.Insights/Metrics/baca	Membaca metrik
Microsoft.Insights/Diagnostic Pengaturan/read	Membaca pengaturan diagnostik sumber daya
Microsoft.Insights/Diagnostic Pengaturan Categories/Read	Membaca kategori pengaturan diagnostik
Microsoft.AAD/domainLayanan/*/baca
Microsoft.Network/virtualNetworks/baca	Dapatkan definisi jaringan virtual
Microsoft.Network/virtualNetworks/subnets/baca	Mendapatkan definisi subnet jaringan virtual
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read	Mendapat definisi peering jaringan virtual
Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnostic Pengaturan/read	Dapatkan pengaturan diagnostik Microsoft Azure Virtual Network
Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read	Mendapatkan metrik yang tersedia untuk PingMesh
Microsoft.Network/azureFirewalls/read	Mendapatkan Azure Firewall
Microsoft.Network/ddosProtectionPlans/read	Mendapatkan Paket Azure DDoS Protection
Microsoft.Network/loadBalancers/baca	Mendapatkan definisi penyeimbang muatan
Microsoft.Network/loadBalancers/*/read
Microsoft.Network/natGateways/read	Mendapatkan Definisi Nat Gateway
Microsoft.Network/networkInterfaces/baca	Mendapatkan definisi antarmuka jaringan.
Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read	Mendapatkan definisi aturan keamanan default
Microsoft.Network/networkSecurityGroups/baca	Mendapatkan definisi kelompok keamanan jaringan
Microsoft.Network/networkSecurityGroups/securityRules/read	Mendapatkan definisi aturan keamanan
Microsoft.Network/routeTables/read	Mendapat definisi tabel rute
Microsoft.Network/routeTables/routes/read	Mendapat definisi rute
NotActions
Tidak ada
DataActions
Tidak ada
NotDataActions
Tidak ada

{
  "assignableScopes": [
    "/"
  ],
  "description": "Can view Azure AD Domain Services and related network configurations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/361898ef-9ed1-48c2-849c-a832951106bb",
  "name": "361898ef-9ed1-48c2-849c-a832951106bb",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/read",
        "Microsoft.Resources/deployments/operations/read",
        "Microsoft.Resources/deployments/operationstatuses/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Insights/AlertRules/Read",
        "Microsoft.Insights/AlertRules/Incidents/Read",
        "Microsoft.Insights/Logs/Read",
        "Microsoft.Insights/Metrics/read",
        "Microsoft.Insights/DiagnosticSettings/read",
        "Microsoft.Insights/DiagnosticSettingsCategories/Read",
        "Microsoft.AAD/domainServices/*/read",
        "Microsoft.Network/virtualNetworks/read",
        "Microsoft.Network/virtualNetworks/subnets/read",
        "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
        "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
        "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Network/azureFirewalls/read",
        "Microsoft.Network/ddosProtectionPlans/read",
        "Microsoft.Network/loadBalancers/read",
        "Microsoft.Network/loadBalancers/*/read",
        "Microsoft.Network/natGateways/read",
        "Microsoft.Network/networkInterfaces/read",
        "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
        "Microsoft.Network/networkSecurityGroups/read",
        "Microsoft.Network/networkSecurityGroups/securityRules/read",
        "Microsoft.Network/routeTables/read",
        "Microsoft.Network/routeTables/routes/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Domain Services Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kontributor Identitas Terkelola

Membuat, Membaca, Memperbarui, dan Menghapus Identitas yang Ditetapkan Pengguna

Pelajari lebih lanjut

Tindakan	Deskripsi
Microsoft.ManagedIdentity/userAssignedIdentities/baca	Mendapatkan identitas yang ditetapkan pengguna yang ada
Microsoft.ManagedIdentity/userAssignedIdentities/tulis	Membuat identitas yang ditetapkan pengguna baru atau memperbarui tag yang terkait dengan identitas yang ditetapkan pengguna yang ada
Microsoft.ManagedIdentity/userAssignedIdentities/hapus	Menghapus identitas pengguna yang ditetapkan pengguna yang sudah ada
Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read	Mendapatkan atau mencantumkan Kredensial Identitas Federasi
Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write	Menambahkan atau memperbarui Kredensial Identitas Federasi
Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete	Menghapus Kredensial Identitas Federasi
Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action	Mencabut semua token yang ada pada identitas yang ditetapkan pengguna
Microsoft.Authorization/*/baca	Membaca peran dan penetapan peran
Microsoft.Insights/alertRules/*	Membuat dan mengelola pemberitahuan metrik klasik
Microsoft.Resources/langganan/resourceGroups/baca	Mendapatkan atau mencantumkan grup sumber daya.
Microsoft.Resources/penyebaran/*	Membuat dan mengelola penyebaran
Microsoft.Support/*	Membuat dan memperbarui tiket dukungan
NotActions
Tidak ada
DataActions
Tidak ada
NotDataActions
Tidak ada

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, Read, Update, and Delete User Assigned Identity",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
  "name": "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
  "permissions": [
    {
      "actions": [
        "Microsoft.ManagedIdentity/userAssignedIdentities/read",
        "Microsoft.ManagedIdentity/userAssignedIdentities/write",
        "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
        "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
        "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
        "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
        "Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Managed Identity Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Operator Identitas Terkelola

Membaca dan Menetapkan Identitas yang Ditetapkan Pengguna