AzureRoleDefinition

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
CustomRoleName	Key	String	Specifies a display name for the custom role definition.
Id	Write	String	Specifies the unique identifier (GUID) of the role definition.
Description	Write	String	Specifies a description for the custom role definition.
Actions	Write	String[]	Specifies the permitted control plane actions for the role definition.
NotActions	Write	String[]	Specifies the excluded control plane actions for the role definition.
DataActions	Write	String[]	Specifies the permitted data plane actions for the role definition.
NotDataActions	Write	String[]	Specifies the excluded data plane actions for the role definition.
AssignableScopes	Write	String[]	Specifies the assignable scopes for the role definition.
Ensure	Write	String	Present ensures the instance exists, absent ensures it is removed.	Present, Absent
SubscriptionId	Write	String	The Azure subscription to connect to if the access is restricted on subscription level.
Credential	Write	PSCredential	Credentials of the workload's Admin
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
ApplicationSecret	Write	PSCredential	Secret of the Azure Active Directory application to authenticate with.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Description

This resource configures Azure RBAC custom role definitions. It only manages custom role definitions, not built-in roles. The account used must have sufficient permissions to manage role definitions, such as Owner or User Access Administrator at the appropriate scope.

New-AzRoleAssignment -ObjectId "<Service Principal Object ID>" -Scope "/" -RoleDefinitionName 'Owner' -ObjectType 'ServicePrincipal'

Permissions

Azure Service Management

To authenticate with the Azure Service Management API, this resource requires the following permissions:

Delegated permissions

• Read

• user_impersonation

• Update

• user_impersonation

Application permissions

• Read

• None

• Update

• None

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AzureRoleDefinition "AzureRoleDefinition-Example"
        {
            Actions               = @("Microsoft.Compute/virtualMachines/read","Microsoft.Compute/virtualMachines/start/action","Microsoft.Compute/virtualMachines/restart/action");
            AssignableScopes      = @("<subscription-scope>");
            CustomRoleName        = "Virtual Machine Operator";
            DataActions           = @("Microsoft.Compute/virtualMachines/login/action");
            Description           = "Allows the platform team to start and restart virtual machines.";
            Ensure                = "Present";
            NotActions            = @("Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/virtualMachines/write");
            NotDataActions        = @("Microsoft.Compute/virtualMachines/loginAsAdmin/action");
            SubscriptionId        = "<subscription-id>";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}

Example 2

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AzureRoleDefinition "AzureRoleDefinition-Example"
        {
            Actions               = @("Microsoft.Compute/virtualMachines/read","Microsoft.Compute/virtualMachines/start/action","Microsoft.Compute/virtualMachines/restart/action","Microsoft.Compute/virtualMachines/deallocate/action");
            AssignableScopes      = @("<subscription-scope>");
            CustomRoleName        = "Virtual Machine Operator";
            DataActions           = @("Microsoft.Compute/virtualMachines/login/action");
            Description           = "Allows the platform team to start, restart and deallocate virtual machines."; # Updated Property
            Ensure                = "Present";
            NotActions            = @("Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/virtualMachines/write");
            NotDataActions        = @("Microsoft.Compute/virtualMachines/loginAsAdmin/action");
            SubscriptionId        = "<subscription-id>";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}

Example 3

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AzureRoleDefinition "AzureRoleDefinition-Example"
        {
            CustomRoleName        = "Virtual Machine Operator";
            Ensure                = "Absent";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}