適用於 Privileged 的 Azure 內建角色

本文列出 Privileged 類別中的 Azure 內建角色。

參與者

授與管理所有資源的完整存取權，但不允許您在 Azure RBAC 中指派角色、在 Azure 藍圖中管理指派，或共用映像庫。

深入了解

動作	描述
*	建立和管理所有類型的資源
NotActions
Microsoft.Authorization/*/Delete	刪除角色、原則指派、原則定義和原則集定義
Microsoft.Authorization/*/Write	建立角色、角色指派、原則指派、原則定義和原則集定義
Microsoft.Authorization/elevateAccess/Action	授與呼叫者租用戶範圍的使用者存取管理員存取
Microsoft.Blueprint/blueprintAssignments/write	建立或更新任何藍圖指派
Microsoft.Blueprint/blueprintAssignments/delete	刪除任何藍圖指派
Microsoft.Compute/galleries/share/action	將資源庫提供給不同的範圍
Microsoft.Purview/consents/write	建立或更新同意資源。
Microsoft.Purview/consents/delete	刪除同意資源。
Microsoft.Resources/deploymentStacks/manageDenySetting/action	管理部署堆疊的 denySettings 屬性。
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
  "name": "b24988ac-6180-42a0-ab88-20f7382dd24c",
  "permissions": [
    {
      "actions": [
        "*"
      ],
      "notActions": [
        "Microsoft.Authorization/*/Delete",
        "Microsoft.Authorization/*/Write",
        "Microsoft.Authorization/elevateAccess/Action",
        "Microsoft.Blueprint/blueprintAssignments/write",
        "Microsoft.Blueprint/blueprintAssignments/delete",
        "Microsoft.Compute/galleries/share/action",
        "Microsoft.Purview/consents/write",
        "Microsoft.Purview/consents/delete",
        "Microsoft.Resources/deploymentStacks/manageDenySetting/action"
      ],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

擁有者

授與管理所有資源的完整存取權，包括在 Azure RBAC 中指派角色的能力。

深入了解

動作	描述
*	建立和管理所有類型的資源
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
  "name": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
  "permissions": [
    {
      "actions": [
        "*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

保留系統管理員

可讓人員讀取和管理租用戶中的所有保留

深入了解

動作	描述
Microsoft.Capacity/*/read
Microsoft.Capacity/*/action
Microsoft.Capacity/*/write
Microsoft.Authorization/roleAssignments/read	取得關於角色指派的資訊。
Microsoft.Authorization/roleDefinitions/read	取得角色定義的相關信息。
Microsoft.Authorization/roleAssignments/write	建立指定範圍的角色指派。
Microsoft.Authorization/roleAssignments/delete	刪除指定範圍內的角色指派。
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/providers/Microsoft.Capacity"
  ],
  "description": "Lets one read and manage all the reservations in a tenant",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a8889054-8d42-49c9-bc1c-52486c10e7cd",
  "name": "a8889054-8d42-49c9-bc1c-52486c10e7cd",
  "permissions": [
    {
      "actions": [
        "Microsoft.Capacity/*/read",
        "Microsoft.Capacity/*/action",
        "Microsoft.Capacity/*/write",
        "Microsoft.Authorization/roleAssignments/read",
        "Microsoft.Authorization/roleDefinitions/read",
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Reservations Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

角色型存取控制系統管理員

藉由使用 Azure RBAC 指派角色，來管理 Azure 資源的存取權。 此角色不允許您使用其他方式來管理存取權，例如 Azure 原則。

動作	描述
Microsoft.Authorization/roleAssignments/write	建立指定範圍的角色指派。
Microsoft.Authorization/roleAssignments/delete	刪除指定範圍內的角色指派。
*/read	讀取除了秘密以外的所有類型的資源。
Microsoft.Support/*	建立和更新支援票證
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/f58310d9-a9f6-439a-9e8d-f62e7b41a168",
  "name": "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete",
        "*/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Role Based Access Control Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

使用者存取系統管理員

可讓您管理使用者對 Azure 資源的存取。

深入了解

動作	描述
*/read	讀取除了秘密以外的所有類型的資源。
Microsoft.Authorization/*	管理授權
Microsoft.Support/*	建立和更新支援票證
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage user access to Azure resources.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
  "name": "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
  "permissions": [
    {
      "actions": [
        "*/read",
        "Microsoft.Authorization/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "User Access Administrator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

下一步

• 使用 Azure 入口網站指派 Azure 角色