你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

用于 Web 和移动的 Azure 内置角色

项目
12/12/2024

本文列出了 Web 和移动类别的 Azure 内置角色。

Azure Maps 数据参与者

从 Azure Maps 帐户中授予地图相关数据的读取、写入和删除权限。

操作	说明
无
不操作
无
DataActions
Microsoft.Maps/accounts/*/read
Microsoft.Maps/accounts/*/write
Microsoft.Maps/accounts/*/delete
Microsoft.Maps/accounts/*/action
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read, write, and delete access to map related data from an Azure maps account.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
  "name": "8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Maps/accounts/*/read",
        "Microsoft.Maps/accounts/*/write",
        "Microsoft.Maps/accounts/*/delete",
        "Microsoft.Maps/accounts/*/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Maps Data Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Maps 数据读取器

授予从 Azure Maps 帐户中读取地图相关数据的权限。

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.Maps/accounts/*/read
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read map related data from an Azure maps account.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
  "name": "423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Maps/accounts/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Maps Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Maps 搜索和呈现数据读取者

授予对常见可视化 Web SDK 场景的非常有限的数据 API 集的访问权限。具体来说，是渲染和搜寻资料 API。

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.Maps/accounts/services/render/read	允许读取呈现服务的数据。
Microsoft.Maps/accounts/services/search/read	允许读取搜索服务的数据。
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to very limited set of data APIs for common visual web SDK scenarios. Specifically, render and search data APIs.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6be48352-4f82-47c9-ad5e-0acacefdb005",
  "name": "6be48352-4f82-47c9-ad5e-0acacefdb005",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.Maps/accounts/services/render/read",
        "Microsoft.Maps/accounts/services/search/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Maps Search and Render Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps 应用程式设定服务设定文件模式读取器角色

读取 Azure Spring Apps 中应用程式设定服务的设定档模式的内容

了解详细信息

操作	说明
Microsoft.AppPlatform/Spring/read	获取 Azure Spring Apps 服务实例
Microsoft.AppPlatform/Spring/configurationServices/read	获取特定 Azure Spring Apps 服务实例的应用程序配置服务
不操作
无
DataActions
Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read	读取应用程序配置服务为特定 Azure Spring Apps 服务实例拉取的配置内容（例如 application-prod.yaml）
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read content of config file pattern for Application Configuration Service in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/25211fc6-dc78-40b6-b205-e4ac934fd9fd",
  "name": "25211fc6-dc78-40b6-b205-e4ac934fd9fd",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/configurationServices/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Application Configuration Service Config File Pattern Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps 应用程序配置服务日志读取者角色

读取 Azure Spring Apps 中应用程式设定服务的即时日志

了解详细信息

操作	说明
Microsoft.AppPlatform/Spring/read	获取 Azure Spring Apps 服务实例
Microsoft.AppPlatform/Spring/configurationServices/read	获取特定 Azure Spring Apps 服务实例的应用程序配置服务
不操作
无
DataActions
Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action	从特定的 Azure Spring Apps 服务实例中读取应用程序配置服务中所有子组件的流式处理日志
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read real-time logs for Application Configuration Service in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6593e776-2a30-40f9-8a32-4fe28b77655d",
  "name": "6593e776-2a30-40f9-8a32-4fe28b77655d",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/configurationServices/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Application Configuration Service Log Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps 链接角色

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/apps/deployments/connect/action	连接到特定应用程序的实例
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Azure Spring Apps Connect Role",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/80558df3-64f9-4c0f-b32d-e5094b036b0b",
  "name": "80558df3-64f9-4c0f-b32d-e5094b036b0b",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/apps/deployments/connect/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Connect Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps 作业日志读取者角色

读取 Azure Spring Apps 中作业的即时日志

了解详细信息

操作	说明
Microsoft.AppPlatform/Spring/read	获取 Azure Spring Apps 服务实例
Microsoft.AppPlatform/Spring/jobs/read	获取特定 Azure Spring Apps 服务实例的作业
Microsoft.AppPlatform/Spring/jobs/executions/read	获取特定 Azure Spring Apps 服务实例的作业执行
不操作
无
DataActions
Microsoft.AppPlatform/Spring/jobs/executions/logstream/action	获取特定 Azure Spring Apps 服务实例的作业执行的流式处理日志
Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action	列出特定 Azure Spring Apps 服务实例的特定作业执行的实例
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read real-time logs for jobs in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b459aa1d-e3c8-436f-ae21-c0531140f43e",
  "name": "b459aa1d-e3c8-436f-ae21-c0531140f43e",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/jobs/read",
        "Microsoft.AppPlatform/Spring/jobs/executions/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/jobs/executions/logstream/action",
        "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Job Log Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps 远端侦错角色

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action	特定应用程序的远程调试应用实例
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Azure Spring Apps Remote Debugging Role",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a99b0159-1064-4c22-a57b-c9b3caa1c054",
  "name": "a99b0159-1064-4c22-a57b-c9b3caa1c054",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Remote Debugging Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Apps Spring Cloud Gateway 日志读取者角色

读取 Azure Spring Apps 中 Spring Cloud Gateway 的即时日志

了解详细信息

操作	说明
Microsoft.AppPlatform/Spring/read	获取 Azure Spring Apps 服务实例
Microsoft.AppPlatform/Spring/gateways/read	获取特定 Azure Spring Apps 服务实例的 Spring Cloud 网关
不操作
无
DataActions
Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action	从特定的 Azure Spring Apps 服务实例中读取 Spring Cloud 网关的流式处理日志
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read real-time logs for Spring Cloud Gateway in Azure Spring Apps",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
  "name": "4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
  "permissions": [
    {
      "actions": [
        "Microsoft.AppPlatform/Spring/read",
        "Microsoft.AppPlatform/Spring/gateways/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Apps Spring Cloud Gateway Log Reader Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Config Server 参与者

允许对 Azure Spring Cloud Config Server 进行读取、写入和删除访问

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/configService/read	读取特定的 Azure Spring Apps 服务实例的配置内容（例如 application.yaml）
Microsoft.AppPlatform/Spring/configService/write	写入特定的 Azure Spring Apps 服务实例的配置服务器内容
Microsoft.AppPlatform/Spring/configService/delete	删除特定的 Azure Spring Apps 服务实例的配置服务器内容
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read, write and delete access to Azure Spring Cloud Config Server",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
  "name": "a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/configService/read",
        "Microsoft.AppPlatform/Spring/configService/write",
        "Microsoft.AppPlatform/Spring/configService/delete"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Config Server Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud Config Server 读者

允许对 Azure Spring Cloud Config Server 进行读取访问

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/configService/read	读取特定的 Azure Spring Apps 服务实例的配置内容（例如 application.yaml）
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read access to Azure Spring Cloud Config Server",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d04c6db6-4947-4782-9e91-30a88feb7be7",
  "name": "d04c6db6-4947-4782-9e91-30a88feb7be7",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/configService/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Config Server Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud 数据读取者

允许对 Azure Spring Cloud 进行读取访问

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/*/read
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read access to Azure Spring Cloud Data",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b5537268-8956-4941-a8f0-646150406f0c",
  "name": "b5537268-8956-4941-a8f0-646150406f0c",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Data Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud 服务注册表参与者

允许对 Azure Spring Cloud 服务注册表进行读取、写入和删除访问

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/eurekaService/read	读取特定的 Azure Spring Apps 服务实例的用户应用注册信息
Microsoft.AppPlatform/Spring/eurekaService/write	写入特定的 Azure Spring Apps 服务实例的用户应用注册信息
Microsoft.AppPlatform/Spring/eurekaService/delete	删除特定的 Azure Spring Apps 服务实例的用户应用注册信息
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read, write and delete access to Azure Spring Cloud Service Registry",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/f5880b48-c26d-48be-b172-7927bfa1c8f1",
  "name": "f5880b48-c26d-48be-b172-7927bfa1c8f1",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/eurekaService/read",
        "Microsoft.AppPlatform/Spring/eurekaService/write",
        "Microsoft.AppPlatform/Spring/eurekaService/delete"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Service Registry Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Spring Cloud 服务注册表读者

允许对 Azure Spring Cloud 服务注册表进行读取访问

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.AppPlatform/Spring/eurekaService/read	读取特定的 Azure Spring Apps 服务实例的用户应用注册信息
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allow read access to Azure Spring Cloud Service Registry",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/cff1b556-2399-4e7e-856d-a8f754be7b65",
  "name": "cff1b556-2399-4e7e-856d-a8f754be7b65",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.AppPlatform/Spring/eurekaService/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Spring Cloud Service Registry Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

媒体服务帐户管理员

创建、读取、修改和删除媒体服务帐户；对其他媒体服务资源的只读访问权限。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Insights/metrics/read	添加指标
Microsoft.Insights/metricDefinitions/read	读取指标定义
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/listStreamingLocators/action	列出资产的流式处理定位符
Microsoft.Media/mediaservices/streamingLocators/listPaths/action	列出路径
Microsoft.Media/mediaservices/write	创建或更新任何媒体服务帐户
Microsoft.Media/mediaservices/delete	删除任何媒体服务帐户
Microsoft.Media/mediaservices/privateEndpointConnectionsApproval/action	审批专用终结点连接
Microsoft.Media/mediaservices/privateEndpointConnections/*
不操作
无
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Media Services accounts; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/054126f8-9a2b-4f1c-a9ad-eca461f08466",
  "name": "054126f8-9a2b-4f1c-a9ad-eca461f08466",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/listStreamingLocators/action",
        "Microsoft.Media/mediaservices/streamingLocators/listPaths/action",
        "Microsoft.Media/mediaservices/write",
        "Microsoft.Media/mediaservices/delete",
        "Microsoft.Media/mediaservices/privateEndpointConnectionsApproval/action",
        "Microsoft.Media/mediaservices/privateEndpointConnections/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Account Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

媒体服务实时事件管理员

创建、读取、修改和删除实时事件、资产、资产筛选器和流式处理定位符；对其他媒体服务资源的只读访问权限。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Insights/metrics/read	添加指标
Microsoft.Insights/metricDefinitions/read	读取指标定义
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/*
Microsoft.Media/mediaservices/assets/assetfilters/*
Microsoft.Media/mediaservices/streamingLocators/*
Microsoft.Media/mediaservices/liveEvents/*
不操作
Microsoft.Media/mediaservices/assets/getEncryptionKey/action	获取资产加密密钥
Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action	列出内容密钥
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Live Events, Assets, Asset Filters, and Streaming Locators; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/532bc159-b25e-42c0-969e-a1d439f60d77",
  "name": "532bc159-b25e-42c0-969e-a1d439f60d77",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/*",
        "Microsoft.Media/mediaservices/assets/assetfilters/*",
        "Microsoft.Media/mediaservices/streamingLocators/*",
        "Microsoft.Media/mediaservices/liveEvents/*"
      ],
      "notActions": [
        "Microsoft.Media/mediaservices/assets/getEncryptionKey/action",
        "Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Live Events Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

媒体服务媒体操作员

创建、读取、修改和删除资产、资产筛选器、流式处理定位符和作业；对其他媒体服务资源的只读访问权限。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Insights/metrics/read	添加指标
Microsoft.Insights/metricDefinitions/read	读取指标定义
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/*
Microsoft.Media/mediaservices/assets/assetfilters/*
Microsoft.Media/mediaservices/streamingLocators/*
Microsoft.Media/mediaservices/transforms/jobs/*
不操作
Microsoft.Media/mediaservices/assets/getEncryptionKey/action	获取资产加密密钥
Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action	列出内容密钥
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Assets, Asset Filters, Streaming Locators, and Jobs; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/e4395492-1534-4db2-bedf-88c14621589c",
  "name": "e4395492-1534-4db2-bedf-88c14621589c",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/*",
        "Microsoft.Media/mediaservices/assets/assetfilters/*",
        "Microsoft.Media/mediaservices/streamingLocators/*",
        "Microsoft.Media/mediaservices/transforms/jobs/*"
      ],
      "notActions": [
        "Microsoft.Media/mediaservices/assets/getEncryptionKey/action",
        "Microsoft.Media/mediaservices/streamingLocators/listContentKeys/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Media Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

媒体服务策略管理员

创建、读取、修改和删除帐户筛选器、流式处理策略、内容密钥策略和转换；对其他媒体服务资源的只读访问权限。不能创建作业、资产或流式处理资源。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Insights/metrics/read	添加指标
Microsoft.Insights/metricDefinitions/read	读取指标定义
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/listStreamingLocators/action	列出资产的流式处理定位符
Microsoft.Media/mediaservices/streamingLocators/listPaths/action	列出路径
Microsoft.Media/mediaservices/accountFilters/*
Microsoft.Media/mediaservices/streamingPolicies/*
Microsoft.Media/mediaservices/contentKeyPolicies/*
Microsoft.Media/mediaservices/transforms/*
不操作
Microsoft.Media/mediaservices/contentKeyPolicies/getPolicyPropertiesWithSecrets/action	获取包含机密的策略属性
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Account Filters, Streaming Policies, Content Key Policies, and Transforms; read-only access to other Media Services resources. Cannot create Jobs, Assets or Streaming resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c4bba371-dacd-4a26-b320-7250bca963ae",
  "name": "c4bba371-dacd-4a26-b320-7250bca963ae",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/listStreamingLocators/action",
        "Microsoft.Media/mediaservices/streamingLocators/listPaths/action",
        "Microsoft.Media/mediaservices/accountFilters/*",
        "Microsoft.Media/mediaservices/streamingPolicies/*",
        "Microsoft.Media/mediaservices/contentKeyPolicies/*",
        "Microsoft.Media/mediaservices/transforms/*"
      ],
      "notActions": [
        "Microsoft.Media/mediaservices/contentKeyPolicies/getPolicyPropertiesWithSecrets/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Policy Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

媒体服务流式处理终结点管理员

创建、读取、修改和删除流式处理终结点；对其他媒体服务资源的只读访问权限。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Insights/metrics/read	添加指标
Microsoft.Insights/metricDefinitions/read	读取指标定义
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Media/mediaservices/*/read
Microsoft.Media/mediaservices/assets/listStreamingLocators/action	列出资产的流式处理定位符
Microsoft.Media/mediaservices/streamingLocators/listPaths/action	列出路径
Microsoft.Media/mediaservices/streamingEndpoints/*
不操作
无
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, read, modify, and delete Streaming Endpoints; read-only access to other Media Services resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/99dba123-b5fe-44d5-874c-ced7199a5804",
  "name": "99dba123-b5fe-44d5-874c-ced7199a5804",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Media/mediaservices/*/read",
        "Microsoft.Media/mediaservices/assets/listStreamingLocators/action",
        "Microsoft.Media/mediaservices/streamingLocators/listPaths/action",
        "Microsoft.Media/mediaservices/streamingEndpoints/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Media Services Streaming Endpoints Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR AccessKey 读取者

读取 SignalR 服务访问密钥

操作	说明
Microsoft.SignalRService/*/read
Microsoft.SignalRService/SignalR/listkeys/action	通过管理门户或 API 查看 SignalR 访问密钥的值
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.Support/*	创建和更新支持票证
不操作
无
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read SignalR Service Access Keys",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/04165923-9d83-45d5-8227-78b77b0a687e",
  "name": "04165923-9d83-45d5-8227-78b77b0a687e",
  "permissions": [
    {
      "actions": [
        "Microsoft.SignalRService/*/read",
        "Microsoft.SignalRService/SignalR/listkeys/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR AccessKey Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR 应用服务器

允许应用服务器使用 AAD 身份验证选项访问 SignalR 服务。

操作	说明
无
不操作
无
DataActions
Microsoft.SignalRService/SignalR/auth/accessKey/action	生成用于对 AccessTokens 进行签名的 AccessKey；默认情况下，此密钥将在 90 分钟后过期
Microsoft.SignalRService/SignalR/serverConnection/write	启动服务器连接
Microsoft.SignalRService/SignalR/clientConnection/write	关闭客户端连接
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets your app server access SignalR Service with AAD auth options.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/420fcaa2-552c-430f-98ca-3264be4806c7",
  "name": "420fcaa2-552c-430f-98ca-3264be4806c7",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/auth/accessKey/action",
        "Microsoft.SignalRService/SignalR/serverConnection/write",
        "Microsoft.SignalRService/SignalR/clientConnection/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR App Server",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR REST API 所有者

完全访问 Azure Signal 服务 REST API

操作	说明
无
不操作
无
DataActions
Microsoft.SignalRService/SignalR/auth/clientToken/action	生成供客户端连接 ASRS 的 AccessToken；默认情况下，该令牌将在 5 分钟后过期
Microsoft.SignalRService/SignalR/hub/*
Microsoft.SignalRService/SignalR/group/*
Microsoft.SignalRService/SignalR/clientConnection/*
Microsoft.SignalRService/SignalR/user/*
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access to Azure SignalR Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/fd53cd77-2268-407a-8f46-7e7863d0f521",
  "name": "fd53cd77-2268-407a-8f46-7e7863d0f521",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/auth/clientToken/action",
        "Microsoft.SignalRService/SignalR/hub/*",
        "Microsoft.SignalRService/SignalR/group/*",
        "Microsoft.SignalRService/SignalR/clientConnection/*",
        "Microsoft.SignalRService/SignalR/user/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR REST API Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR REST API 读者

以只读方式访问 Azure Signal 服务 REST API

操作	说明
无
不操作
无
DataActions
Microsoft.SignalRService/SignalR/group/read	检查组是否存在或用户是否存在于组中
Microsoft.SignalRService/SignalR/clientConnection/read	检查客户端连接是否存在
Microsoft.SignalRService/SignalR/user/read	检查用户是否存在
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read-only access to Azure SignalR Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/ddde6b66-c0df-4114-a159-3618637b3035",
  "name": "ddde6b66-c0df-4114-a159-3618637b3035",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/group/read",
        "Microsoft.SignalRService/SignalR/clientConnection/read",
        "Microsoft.SignalRService/SignalR/user/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR REST API Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR 服务所有者

完全访问 Azure Signal 服务 REST API

操作	说明
无
不操作
无
DataActions
Microsoft.SignalRService/SignalR/*
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access to Azure SignalR Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
  "name": "7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/SignalR/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR Service Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

SignalR/Web PubSub 参与者

创建、读取、更新和删除 SignalR 服务资源

操作	说明
Microsoft.SignalRService/*
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Support/*	创建和更新支持票证
不操作
无
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Create, Read, Update, and Delete SignalR service resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
  "name": "8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
  "permissions": [
    {
      "actions": [
        "Microsoft.SignalRService/*",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "SignalR/Web PubSub Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Web 计划参与者

管理网站的 web 计划。不允许在 Azure RBAC 中分配角色。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.Support/*	创建和更新支持票证
Microsoft.Web/serverFarms/*	创建和管理服务器场
Microsoft.Web/hostingEnvironments/Join/Action	加入应用服务环境
Microsoft.Insights/autoscalesettings/*
不操作
无
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage the web plans for websites, but not access to them.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
  "name": "2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Web/serverFarms/*",
        "Microsoft.Web/hostingEnvironments/Join/Action",
        "Microsoft.Insights/autoscalesettings/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Web Plan Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Web PubSub 服务所有者

對 Azure Web PubSub 服務 REST API 的完全存取權限

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.SignalRService/WebPubSub/*
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Full access to Azure Web PubSub Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/12cf5a90-567b-43ae-8102-96cf46c7d9b4",
  "name": "12cf5a90-567b-43ae-8102-96cf46c7d9b4",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/WebPubSub/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Web PubSub Service Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Web PubSub 服务阅读器

对 Azure Web PubSub 服务 REST API 的唯读访问

了解详细信息

操作	说明
无
不操作
无
DataActions
Microsoft.SignalRService/WebPubSub/*/read
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Read-only access to Azure Web PubSub Service REST APIs",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
  "name": "bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
  "permissions": [
    {
      "actions": [],
      "notActions": [],
      "dataActions": [
        "Microsoft.SignalRService/WebPubSub/*/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Web PubSub Service Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

网站参与者

管理网站，但不管理 web 计划。不允许在 Azure RBAC 中分配角色。

操作	说明
Microsoft.Authorization/*/read	读取角色和角色分配
Microsoft.Insights/alertRules/*	创建和管理经典指标警报
Microsoft.Insights/components/*	创建和管理 Insights 组件
Microsoft.ResourceHealth/availabilityStatuses/read	获取指定范围内所有资源的可用性状态
Microsoft.Resources/deployments/*	创建和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	获取或列出资源组。
Microsoft.Support/*	创建和更新支持票证
Microsoft.Web/certificates/*	创建和管理网站证书
Microsoft.Web/listSitesAssignedToHostName/read	获取分配给主机名的站点名称。
Microsoft.Web/register/action	注册订阅的 Microsoft.Web 资源提供程序。
Microsoft.Web/serverFarms/join/action	加入应用服务计划
Microsoft.Web/serverFarms/read	获取应用服务计划的属性
Microsoft.Web/sites/*	创建和管理网站（站点创建还需要对关联的应用服务计划有写入权限）
不操作
无
DataActions
无
NotDataActions
无

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage websites (not web plans), but not access to them.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/de139f84-1756-47ae-9be6-808fbbe84772",
  "name": "de139f84-1756-47ae-9be6-808fbbe84772",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/components/*",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Web/certificates/*",
        "Microsoft.Web/listSitesAssignedToHostName/read",
        "Microsoft.Web/register/action",
        "Microsoft.Web/serverFarms/join/action",
        "Microsoft.Web/serverFarms/read",
        "Microsoft.Web/sites/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Website Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

后续步骤

使用 Azure 门户分配 Azure 角色

通过

用于 Web 和移动的 Azure 内置角色

Azure Maps 数据参与者

Azure Maps 数据读取器

Azure Maps 搜索和呈现数据读取者

Azure Spring Apps 应用程式设定服务设定文件模式读取器角色

Azure Spring Apps 应用程序配置服务日志读取者角色

Azure Spring Apps 链接角色

Azure Spring Apps 作业日志读取者角色

Azure Spring Apps 远端侦错角色

Azure Spring Apps Spring Cloud Gateway 日志读取者角色

Azure Spring Cloud Config Server 参与者

Azure Spring Cloud Config Server 读者

Azure Spring Cloud 数据读取者

Azure Spring Cloud 服务注册表参与者

Azure Spring Cloud 服务注册表读者

媒体服务帐户管理员

媒体服务实时事件管理员

媒体服务媒体操作员

媒体服务策略管理员

媒体服务流式处理终结点管理员

SignalR AccessKey 读取者

SignalR 应用服务器

SignalR REST API 所有者

SignalR REST API 读者

SignalR 服务所有者

SignalR/Web PubSub 参与者

Web 计划参与者

Web PubSub 服务所有者

Web PubSub 服务阅读器

网站参与者

后续步骤

反馈

其他资源