分享方式：

適用於物聯網的 Azure 內建角色

  • 文章

本文列出物聯網類別中的 Azure 內建角色。

Azure Digital Twins 資料擁有者

Digital Twins 數據平面的完整存取角色

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.DigitalTwins/digitaltwins/* 讀取、建立、更新或刪除任何 Digital Twin
Microsoft.DigitalTwins/digitaltwins/commands/* 在 Digital Twin 上叫用任何命令
Microsoft.DigitalTwins/digitaltwins/relationships/* 讀取、建立、更新或刪除任何 Digital Twin 關聯性
Microsoft.DigitalTwins/eventroutes/* 讀取、刪除、建立或更新任何事件路由
Microsoft.DigitalTwins/jobs/*
Microsoft.DigitalTwins/models/* 讀取、建立、更新或刪除任何模型
Microsoft.DigitalTwins/query/* 查詢任何 Digital Twins 圖形
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access role for Digital Twins data-plane",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/bcd981a7-7f74-457b-83e1-cceb9e632ffe",
  "name": "bcd981a7-7f74-457b-83e1-cceb9e632ffe",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.DigitalTwins/digitaltwins/*",
        "Microsoft.DigitalTwins/digitaltwins/commands/*",
        "Microsoft.DigitalTwins/digitaltwins/relationships/*",
        "Microsoft.DigitalTwins/eventroutes/*",
        "Microsoft.DigitalTwins/jobs/*",
        "Microsoft.DigitalTwins/models/*",
        "Microsoft.DigitalTwins/query/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Digital Twins Data Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Digital Twins 資料讀者

Digital Twins 數據平面屬性的唯讀角色

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.DigitalTwins/digitaltwins/read 讀取任何數字對應項
Microsoft.DigitalTwins/digitaltwins/relationships/read 讀取任何數字對應項關聯性
Microsoft.DigitalTwins/eventroutes/read 讀取任何事件路由
Microsoft.DigitalTwins/jobs/import/read 讀取任何大容量導入作業
Microsoft.DigitalTwins/jobs/imports/read 讀取任何大容量導入作業
Microsoft.DigitalTwins/jobs/deletions/read 讀取任何大量刪除作業
Microsoft.DigitalTwins/models/read 讀取任何模型
Microsoft.DigitalTwins/query/action 查詢任何 Digital Twins 圖形
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Read-only role for Digital Twins data-plane properties",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d57506d4-4c8d-48b1-8587-93c323f6a5a3",
  "name": "d57506d4-4c8d-48b1-8587-93c323f6a5a3",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.DigitalTwins/digitaltwins/read",
        "Microsoft.DigitalTwins/digitaltwins/relationships/read",
        "Microsoft.DigitalTwins/eventroutes/read",
        "Microsoft.DigitalTwins/jobs/import/read",
        "Microsoft.DigitalTwins/jobs/imports/read",
        "Microsoft.DigitalTwins/jobs/deletions/read",
        "Microsoft.DigitalTwins/models/read",
        "Microsoft.DigitalTwins/query/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Digital Twins Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

裝置佈建服務資料參與者

允許完整存取裝置佈建服務資料平面作業。

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.Devices/provisioningServices/*
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows for full access to Device Provisioning Service data-plane operations.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/dfce44e4-17b7-4bd1-a6d1-04996ec95633",
  "name": "dfce44e4-17b7-4bd1-a6d1-04996ec95633",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Devices/provisioningServices/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Provisioning Service Data Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

裝置佈建服務資料讀者

允許完整讀取存取裝置佈建服務資料平面屬性。

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.Devices/provisioningServices/*/read
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows for full read access to Device Provisioning Service data-plane properties.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/10745317-c249-44a1-a5ce-3a4353c0bbd8",
  "name": "10745317-c249-44a1-a5ce-3a4353c0bbd8",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Devices/provisioningServices/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Provisioning Service Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Device Update 系統管理員

提供您管理與內容作業的完整存取權

深入了解

動作 描述
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/deployments/* 建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Support/* 建立和更新支援票證
Microsoft.Insights/alertRules/* 建立和管理傳統計量警示
NotActions
none
DataActions
Microsoft.DeviceUpdate/accounts/instances/updates/read 執行與更新相關的讀取作業
Microsoft.DeviceUpdate/accounts/instances/updates/write 執行與更新相關的寫入作業
Microsoft.DeviceUpdate/accounts/instances/updates/delete 執行與更新相關的刪除作業
Microsoft.DeviceUpdate/accounts/instances/management/read 執行與管理相關的讀取作業
Microsoft.DeviceUpdate/accounts/instances/management/write 執行與管理相關的寫入作業
Microsoft.DeviceUpdate/accounts/instances/management/delete 執行與管理相關的刪除作業
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Gives you full access to management and content operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/02ca0879-e8e4-47a5-a61e-5c618b76e64a",
  "name": "02ca0879-e8e4-47a5-a61e-5c618b76e64a",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Insights/alertRules/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
        "Microsoft.DeviceUpdate/accounts/instances/updates/write",
        "Microsoft.DeviceUpdate/accounts/instances/updates/delete",
        "Microsoft.DeviceUpdate/accounts/instances/management/read",
        "Microsoft.DeviceUpdate/accounts/instances/management/write",
        "Microsoft.DeviceUpdate/accounts/instances/management/delete"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Update Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Device Update 內容管理員

讓您完整存取內容作業

深入了解

動作 描述
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/deployments/* 建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Support/* 建立和更新支援票證
Microsoft.Insights/alertRules/* 建立和管理傳統計量警示
NotActions
none
DataActions
Microsoft.DeviceUpdate/accounts/instances/updates/read 執行與更新相關的讀取作業
Microsoft.DeviceUpdate/accounts/instances/updates/write 執行與更新相關的寫入作業
Microsoft.DeviceUpdate/accounts/instances/updates/delete 執行與更新相關的刪除作業
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Gives you full access to content operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/0378884a-3af5-44ab-8323-f5b22f9f3c98",
  "name": "0378884a-3af5-44ab-8323-f5b22f9f3c98",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Insights/alertRules/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
        "Microsoft.DeviceUpdate/accounts/instances/updates/write",
        "Microsoft.DeviceUpdate/accounts/instances/updates/delete"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Update Content Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Device Update 內容讀取者

可讓您讀取內容作業的存取權，但不允許進行變更

深入了解

動作 描述
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/deployments/* 建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Support/* 建立和更新支援票證
Microsoft.Insights/alertRules/* 建立和管理傳統計量警示
NotActions
none
DataActions
Microsoft.DeviceUpdate/accounts/instances/updates/read 執行與更新相關的讀取作業
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Gives you read access to content operations, but does not allow making changes",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d1ee9a80-8b14-47f0-bdc2-f4a351625a7b",
  "name": "d1ee9a80-8b14-47f0-bdc2-f4a351625a7b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Insights/alertRules/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Update Content Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Device Update 部署管理員

提供您管理作業的完整存取權

深入了解

動作 描述
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/deployments/* 建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Support/* 建立和更新支援票證
Microsoft.Insights/alertRules/* 建立和管理傳統計量警示
NotActions
none
DataActions
Microsoft.DeviceUpdate/accounts/instances/management/read 執行與管理相關的讀取作業
Microsoft.DeviceUpdate/accounts/instances/management/write 執行與管理相關的寫入作業
Microsoft.DeviceUpdate/accounts/instances/management/delete 執行與管理相關的刪除作業
Microsoft.DeviceUpdate/accounts/instances/updates/read 執行與更新相關的讀取作業
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Gives you full access to management operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/e4237640-0e3d-4a46-8fda-70bc94856432",
  "name": "e4237640-0e3d-4a46-8fda-70bc94856432",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Insights/alertRules/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.DeviceUpdate/accounts/instances/management/read",
        "Microsoft.DeviceUpdate/accounts/instances/management/write",
        "Microsoft.DeviceUpdate/accounts/instances/management/delete",
        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Update Deployments Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Device Update 部署讀取者

可讓您讀取管理作業的存取權，但不允許進行變更

深入了解

動作 描述
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/deployments/* 建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Support/* 建立和更新支援票證
Microsoft.Insights/alertRules/* 建立和管理傳統計量警示
NotActions
none
DataActions
Microsoft.DeviceUpdate/accounts/instances/management/read 執行與管理相關的讀取作業
Microsoft.DeviceUpdate/accounts/instances/updates/read 執行與更新相關的讀取作業
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Gives you read access to management operations, but does not allow making changes",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/49e2f5d2-7741-4835-8efa-19e1fe35e47f",
  "name": "49e2f5d2-7741-4835-8efa-19e1fe35e47f",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Insights/alertRules/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.DeviceUpdate/accounts/instances/management/read",
        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Update Deployments Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Device Update 讀取者

可讓您讀取管理和內容作業的存取權，但不允許進行變更

深入了解

動作 描述
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/deployments/* 建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Support/* 建立和更新支援票證
Microsoft.Insights/alertRules/* 建立和管理傳統計量警示
NotActions
none
DataActions
Microsoft.DeviceUpdate/accounts/instances/updates/read 執行與更新相關的讀取作業
Microsoft.DeviceUpdate/accounts/instances/management/read 執行與管理相關的讀取作業
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Gives you read access to management and content operations, but does not allow making changes",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/e9dba6fb-3d52-4cf0-bce3-f06ce71b9e0f",
  "name": "e9dba6fb-3d52-4cf0-bce3-f06ce71b9e0f",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Insights/alertRules/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
        "Microsoft.DeviceUpdate/accounts/instances/management/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Device Update Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

韌體分析管理員

在適用於IoT的Defender中上傳和分析韌體映像

深入了解

動作 描述
Microsoft.IoTFirmwareDefense/*
Microsoft.Authorization/*/read 讀取角色和角色指派
Microsoft.Resources/subscriptions/resourceGroups/read 取得或列出資源群組。
Microsoft.Resources/deployments/* 建立和管理部署
NotActions
none
DataActions
none
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Upload and analyze firmware images in Defender for IoT",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/9c1607d1-791d-4c68-885d-c7b7aaff7c8a",
  "name": "9c1607d1-791d-4c68-885d-c7b7aaff7c8a",
  "permissions": [
    {
      "actions": [
        "Microsoft.IoTFirmwareDefense/*",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Firmware Analysis Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

IoT 中樞資料貢獻者

允許完整存取 IoT 中樞 數據平面作業。

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.Devices/IotHubs/*
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows for full access to IoT Hub data plane operations.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4fc6c259-987e-4a07-842e-c321cc9d413f",
  "name": "4fc6c259-987e-4a07-842e-c321cc9d413f",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Devices/IotHubs/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "IoT Hub Data Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

IoT 中樞資料讀取器

允許完整讀取 IoT 中樞 數據平面屬性

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.Devices/IotHubs/*/read
Microsoft.Devices/IotHubs/fileUpload/notifications/action 接收、完成或放棄檔案上傳通知
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows for full read access to IoT Hub data-plane properties",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b447c946-2db7-41ec-983d-d8bf3b1c77e3",
  "name": "b447c946-2db7-41ec-983d-d8bf3b1c77e3",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Devices/IotHubs/*/read",
        "Microsoft.Devices/IotHubs/fileUpload/notifications/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "IoT Hub Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

IoT 中樞登錄參與者

允許完整存取 IoT 中樞 裝置登錄。

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.Devices/IotHubs/devices/*
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows for full access to IoT Hub device registry.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4ea46cd5-c1b2-4a8e-910b-273211f9ce47",
  "name": "4ea46cd5-c1b2-4a8e-910b-273211f9ce47",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Devices/IotHubs/devices/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "IoT Hub Registry Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

IoT 中樞對應項參與者

允許所有 IoT 中樞 裝置和模組對應項的讀取和寫入存取權。

深入了解

動作 描述
none
NotActions
none
DataActions
Microsoft.Devices/IotHubs/twins/*
NotDataActions
none 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows for read and write access to all IoT Hub device and module twins.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/494bdba2-168f-4f31-a0a1-191d2f7c028c",
  "name": "494bdba2-168f-4f31-a0a1-191d2f7c028c",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Devices/IotHubs/twins/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "IoT Hub Twin Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

下一步