Hello all,
Azure provides the ability to create Custom Roles in order to better fit the needs and give admins more flexible ways to choose the permissions they want to provide to users.
Many posts discuss the Azure RBAC and custom roles, here’s some materials:
- Azure RBAC : https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure
- Azure RBAC Built-In roles : https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-built-in-roles
- Azure RBAC Custom Roles : https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-custom-roles
In this post I will clarify the right method to modify an existing created custom role.
When you create a custom role, you configure many parameters:
- Custom Role Name
- Custom Role description
- Custom Role Actions
- Custom Role No-Actions
- Custom Role assignable scopes
There are some scenarios where you would like to change one or more of the definitions, for several reasons:
– You already created a custom role assigned to only some scopes. You want to extend or reduce the scopes
– You decided to add or remove an Action or a No-Action to an existing custom role
– You noticed a typo on the description and you decided to change it
– And more reasons can come…
How to proceed ?
This step by step is using Azure Powershell, so download and install Azure powershell before proceeding. (Download and Install Azure powershell)
As an example, i will make several changes to the Azure Custom Role “Azure DNS Reader” that initially has the scope at the subscription level “/subscriptions/1111111-1111-1111-11111-11111111111”. The changes are:
- New Name –> Azure DNS Zone RW
- Change the description –> Lets you view and modify Azure DNS zone objects”Add or remove an Action –> Microsoft.Network/dnsZones/write”
- Add or remove a No-Action –> Microsoft.Network/dnsZones/write”
- Add a remove a scope –> “/subscriptions/222222-2222-2222-2222-2222222222222”
1- Login to Azure
Login to Azure using the following command:
Login-AzureRmAccount
2- Get the Custom Role Definition :
- If your custom role is assigned to the default subscription : $CustomRole = Get-AzureRmRoleDefinition -Name “Azure DNS Reader”
- If your custom role is assigned to a scope : $CustomRole = Get-AzureRmRoleDefinition -Name “Azure DNS Reader” -Scope “/subscriptions/1111111-1111-1111-11111-11111111111”
3- Make changes* and commit
*Note that you can make all the changes and commit during last step
A- Change the role Name
$CustomRole.Name = “Azure DNS Zone RW”
$CustomRole | Set-AzureRmRoleDefinition
B- Change the role description
$CustomRole.Description = “Lets you view and modify Azure DNS zone objects”
$CustomRole | Set-AzureRmRoleDefinition
C- Add or Remove an Action
$Action = “Microsoft.Network/dnsZones/write”
$CustomRole.Actions.Add($Action)
#or to remove
$CustomRole.Actions.Remove($Action)
$CustomRole | Set-AzureRmRoleDefinition
D- Add or Remove a No-Action
$NoAction = “Microsoft.Network/dnsZones/write”
$CustomRole.NotActions.Add($Action)
#or
$CustomRole.NotActions.Remove($NoAction)
$CustomRole | Set-AzureRmRoleDefinition
E- Add or Remove a Scope
$Scope = “/subscriptions/222222-2222-2222-2222-2222222222222”
$CustomRole.AssignableScopes.Add($Scope)
#or
$CustomRole.AssignableScopes.Remove($Scope)
$CustomRole | Set-AzureRmRoleDefinition
buildwindows 