Question 104340 in Azure Question posted in
The official documentation to get you started can be found here.

How to customize Subscription contributor role for blocking Storage in Azure

I have a requirement to customize the contributor role at Azure Subscription level, such that, people added to that customized contributor role can NOT view or read the data from the storage account (under that subscription).

This is how i’m doing this:

Step1
Clone Subscription contributor Basic

Step2
Permission

Step3 ( Actions shows * )
JSON

Review and Create

This MSFT link does NOT show me the JSON details that can be removed or added so that the read access to the storage account can be blocked.

Hence, I’m trying below ways to customize this (two assignable scopes to cover subscription as well as block viewing the storage data):

2 assignable scope

Note, The idea is to People need a contributor role to manage the subscription. However, they MUST NOT view the data from the storage under this particular subscription.

I think this is not the right approach. Are there any other ways to achieve this? Thanks.

Tags:

2

Answers


  1. 0

    If you want to create a custom role, then you should have a look at the resource provider operations. From there, you can see all the available actions per resource provider.

    You would probably be interested in the DataActions such as Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read and others depending on what you want to filter out.

    Login or Signup to reply.
  2. 0

    If you want to block particularly Azure Storage under Subscription Scope Level.

    Kindly Exclude Azure Storage under Add Permission Section in order to block Azure Storage only while creating RBAC Role

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search