+- You can deploy an App Service Environment v3 that's enabled for zone redundancy. You set zone redundancy only during creation and only in regions where all App Service Environment v3 dependencies are zone redundant. This is a deployment time only decision. Changing zone redundancy is not possible after it has been deployed. With zone redundant App Service Environment, each App Service Plan on the App Service Environment will need to have a minimum of three instances so that they can be spread across zones. For more information, see [Migrate App Service Environment to availability zone support](../../availability-zones/migrate-app-service-environment.md).

+| Sweden South | ✅ | |

+| | App Service Environment v3 | App Service Environment v3 |

+## Pricing tiers

+The following sections list the regional pricing tiers (SKUs) availability for App Service Environment v3.

+> [!NOTE]

+> Windows Container plans currently do not support memory intensive SKUs.

+>

+

+### Azure Public:

+| Region | Standard | Large | Memory intensive |

+| -- | :-: | :: | :: |

+| | I1v2-I3v2 | I4v2-I6v2 | I1mv2-I5mv2 |

+| Australia Central | ✅ | ✅ | ✅ |

+| Australia Central 2 | ✅ | ✅ | ✅ |

+| Australia East | ✅ | ✅ | ✅ |

+| Australia Southeast | ✅ | ✅ | ✅ |

+| Brazil South | ✅ | ✅ | |

+| Brazil Southeast | ✅ | ✅ | ✅ |

+| Canada Central | ✅ | ✅ | ✅ |

+| Canada East | ✅ | ✅ | ✅ |

+| Central India | ✅ | ✅ | ✅ |

+| Central US | ✅ | ✅ * | |

+| East Asia | ✅ | ✅ | ✅ |

+| East US | ✅ | ✅ | |

+| East US 2 | ✅ | ✅ | ✅ |

+| France Central | ✅ | ✅ | ✅ |

+| France South | ✅ | ✅ | ✅ |

+| Germany North | ✅ | ✅ | ✅ |

+| Germany West Central | ✅ | ✅ | ✅ |

+| Israel Central | ✅ | ✅ | |

+| Italy North | ✅ | ✅ | |

+| Japan East | ✅ | ✅ | ✅ |

+| Japan West | ✅ | ✅ | ✅ |

+| Jio India Central | ✅ | ✅ | |

+| Jio India West | ✅ | ✅ | |

+| Korea Central | ✅ | ✅ | |

+| Korea South | ✅ | ✅ | ✅ |

+| Mexico Central | ✅ | ✅ | |

+| North Central US | ✅ | ✅ | ✅ |

+| North Europe | ✅ | ✅ | ✅ |

+| Norway East | ✅ | ✅ | ✅ |

+| Norway West | ✅ | ✅ | ✅ |

+| Poland Central | ✅ | ✅ | |

+| Qatar Central | ✅ | ✅ | |

+| South Africa North | ✅ | ✅ | ✅ |

+| South Africa West | ✅ | ✅ | ✅ |

+| South Central US | ✅ | ✅ | ✅ |

+| South India | ✅ | ✅ | |

+| Southeast Asia | ✅ | ✅ | ✅ |

+| Spain Central | ✅ | ✅ | |

+| Sweden Central | ✅ | ✅ | ✅ |

+| Sweden South | ✅ | ✅ | ✅ |

+| Switzerland North | ✅ | ✅ | ✅ |

+| Switzerland West | ✅ | ✅ | ✅ |

+| UAE Central | ✅ | ✅ | |

+| UAE North | ✅ | ✅ | ✅ |

+| UK South | ✅ | ✅ | ✅ |

+| UK West | ✅ | ✅ | ✅ |

+| West Central US | ✅ | ✅ * | |

+| West Europe | ✅ | ✅ * | |

+| West India | ✅ | ✅ | ✅ |

+| West US | ✅ | ✅ | |

+| West US 2 | ✅ | ✅ | ✅ |

+| West US 3 | ✅ | ✅ | ✅ |

+\* Windows Container does not support Large skus in this region.

+\** Linux does not support Memory intensive skus in this region.

+### Azure Government:

+| Region | Standard | Large | Memory intensive |

+| -- | :-: | :: | :: |

+| | I1v2-I3v2 | I4v2-I6v2 | I1mv2-I5mv2 |

+| US DoD Central | ✅ |✅ * | |

+| US DoD East | ✅ |✅ * | |

+| US Gov Arizona | ✅ |✅ * | |

+| US Gov Texas | ✅ |✅ * | |

+| US Gov Virginia | ✅ |✅ * | |

+### Microsoft Azure operated by 21Vianet:

+| Region | Standard | Large | Memory intensive |

+| -- | :-: | :: | :: |

+| | I1v2-I3v2 | I4v2-I6v2 | I1mv2-I5mv2 |

+| China East 3 | ✅ | ✅ * | |

+| China North 3 | ✅ | ✅ * | |

+Review the [requirements and limitations](overview-arc-integration.md) of the public preview. Of particular importance are the cluster requirements.

+> This tutorial uses [Azure Kubernetes Service (AKS)](/azure/aks/) to provide concrete instructions for setting up an environment from scratch. However, for a production workload, you will likely not want to enable Azure Arc on an AKS cluster as it is already managed in Azure. The steps will help you get started understanding the service, but for production deployments, they should be viewed as illustrative, not prescriptive. See [Quickstart: Connect an existing Kubernetes cluster to Azure Arc](/azure/azure-arc/kubernetes/quickstart-connect-cluster) for general instructions on creating an Azure Arc-enabled Kubernetes cluster.

+1. Set the following environment variables for the desired name of the [App Service extension](overview-arc-integration.md), the cluster namespace in which resources should be provisioned, and the name for the App Service Kubernetes environment. Choose a unique name for `<kube-environment-name>`, because it is part of the domain name for app created in the App Service Kubernetes environment.

+ | `Microsoft.CustomLocation.ServiceAccount` | The service account that should be created for the custom location that is created. It is recommended that this be set to the value `default`. |

+ | `clusterName` | The name of the App Service Kubernetes environment that is created against this extension. |

+ | `buildService.storageClassName` | The [name of the storage class](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class) for the build service to store build artifacts. A value like `default` specifies a class named `default`, and not [any class that is marked as default](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/). Default is a valid storage class for AKS and AKS HCI but it may not be for other distrubtions/platforms. |

+ | `buildService.storageAccessMode` | The [access mode](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) to use with the named storage class. Accepts `ReadWriteOnce` or `ReadWriteMany`. |

+ | `customConfigMap` | The name of the config map that will be set by the App Service Kubernetes environment. Currently, it must be `<namespace>/kube-environment-config`, replacing `<namespace>` with the value of `appsNamespace`. |

+You can use `kubectl` to see the pods created in your Kubernetes cluster:

+| Node OS requirement | **Linux** only. |

+- [Can the extension be installed on Windows nodes?](#can-the-extension-be-installed-on-windows-nodes)

+- [Can I deploy the Application services extension on an Arm64 based cluster?](#can-i-deploy-the-application-services-extension-on-an-arm64-based-cluster)

+### Can the extension be installed on Windows nodes?

+No, the extension cannot be installed on Windows nodes. The extension supports installation on **Linux** nodes **only**.

+When creating a Kubernetes environment resource, some subscriptions might see a "No registered resource provider found" error. The error details might include a set of locations and API versions that are considered valid. If this error message is returned, the subscription must be re-registered with the Microsoft.Web provider, an operation that has no impact on existing applications or APIs. To re-register, use the Azure CLI to run `az provider register --namespace Microsoft.Web --wait`. Then reattempt the Kubernetes environment command.

+### Can I deploy the Application services extension on an Arm64 based cluster?

+Arm64 based clusters aren't supported at this time.

+* Support for using identity instead of secrets for connecting to the storage provider.

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+`"appServiceNamePrefix`": {`"value`":`"demoApp`"} }"

+\"appServiceNamePrefix\": {\"value\":\"demoApp\"} }"

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+var appServicePlanSku = 'B1'

+var linuxFxVersion = 'DOTNETCORE|8.0'

+resource appServicePlan 'Microsoft.Web/serverfarms@2023-01-01' = {

+ kind: 'linux'

+ properties: {

+ zoneRedundant: false

+ reserved: true

+ }

+resource appService 'Microsoft.Web/sites@2023-01-01' = {

+ redundancyMode: 'None'

+ linuxFxVersion: linuxFxVersion

+ minTlsVersion: '1.2'

+ ftpsState: 'Disabled'

+output appServicePlan string = appServicePlanName

+output appServiceApp string = appService.properties.defaultHostName

+# [Azure PowerShell](#tab/azure-powershell)

+ "version": "0.30.3.12046",

+ "templateHash": "16466621031230437685"

+ "appServicePlanSku": "B1",

+ "linuxFxVersion": "DOTNETCORE|8.0"

+ "apiVersion": "2023-01-01",

+ },

+ "kind": "linux",

+ "properties": {

+ "zoneRedundant": false,

+ "reserved": true

+ "apiVersion": "2023-01-01",

+ "redundancyMode": "None",

+ "linuxFxVersion": "[variables('linuxFxVersion')]",

+ "minTlsVersion": "1.2",

+ "ftpsState": "Disabled"

+ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]"

+ "value": "[reference(resourceId('Microsoft.Web/sites', variables('appServiceName')), '2023-01-01').defaultHostName]"

+In this example, the user interface prompts you to input the App Service name prefix and App Service plan's name. During deployment of _mainTemplate.json_ the `appServiceName` variables uses the `uniqueString` function to append a 13-character string to the name prefix so the name is globally unique across Azure.

+ "appServiceNamePrefix": "[steps('webAppSettings').appServiceName]"

+# [Azure PowerShell](#tab/azure-powershell)

+After you create the storage account, add the role assignment _Storage Blob Data Contributor_ to the storage account scope. Assign access to your Microsoft Entra user account. Depending on your access level in Azure, you might need other permissions assigned by your administrator. For more information, see [Assign an Azure role for access to blob data](../../storage/blobs/assign-azure-role-data-access.md) and [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml).

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+| `packageFileUri` | Enter the URI for your _.zip_ package file. Use your `packageuri` variable's value. |

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+Add the following JSON and save the file. It defines the resources to deploy an App Service and App Service plan. The template uses the App Service Basic plan (B1) that has pay-as-you-go costs. For more information, see [Azure App Service on Linux pricing](https://azure.microsoft.com/pricing/details/app-service/linux/).

+ "appServicePlanSku": "B1",

+ "linuxFxVersion": "DOTNETCORE|8.0"

+ "apiVersion": "2023-01-01",

+ },

+ "kind": "linux",

+ "properties": {

+ "zoneRedundant": false,

+ "reserved": true

+ "apiVersion": "2023-01-01",

+ "redundancyMode": "None",

+ "linuxFxVersion": "[variables('linuxFxVersion')]",

+ "minTlsVersion": "1.2",

+ "ftpsState": "Disabled"

+ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]"

+ "value": "[reference(resourceId('Microsoft.Web/sites', variables('appServiceName')), '2023-01-01').defaultHostName]"

+In this example, the user interface prompts you to input the App Service name prefix and App Service plan's name. During deployment of _mainTemplate.json_ the `appServiceName` variables uses the `uniqueString` function to append a 13-character string to the name prefix so the name is globally unique across Azure.

+ "appServiceNamePrefix": "[steps('webAppSettings').appServiceName]"

+# [Azure PowerShell](#tab/azure-powershell)

+After you create the storage account, add the role assignment _Storage Blob Data Contributor_ to the storage account scope. Assign access to your Microsoft Entra user account. Depending on your access level in Azure, you might need other permissions assigned by your administrator. For more information, see [Assign an Azure role for access to blob data](../../storage/blobs/assign-azure-role-data-access.md) and [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml).

+ - **Region**: _West US_

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+ - **Region**: _West US_

+ The **Lock level** on the managed resource group prevents the customer from performing undesirable operations on this resource group. `Read Only` specifies that the customer can only read the resources present in the managed resource group. The publisher identities that are granted access to the managed resource group are exempt from the lock level.

+# [Azure PowerShell](#tab/azure-powershell)

+ "appServicePlanSku": "B1",

+ "linuxFxVersion": "DOTNETCORE|8.0"

+ "apiVersion": "2023-01-01",

+ },

+ "kind": "linux",

+ "properties": {

+ "zoneRedundant": false,

+ "reserved": true

+ "apiVersion": "2023-01-01",

+ "redundancyMode": "None",

+ "linuxFxVersion": "[variables('linuxFxVersion')]",

+ "minTlsVersion": "1.2",

+ "ftpsState": "Disabled"

+ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]"

+ "value": "[reference(resourceId('Microsoft.Web/sites', variables('appServiceName')), '2023-01-01').defaultHostName]"

+In this example, the user interface prompts you to input the App Service name prefix and App Service plan's name. During deployment of _mainTemplate.json_ the `appServiceName` variables uses the `uniqueString` function to append a 13-character string to the name prefix so the name is globally unique across Azure.

+ "appServiceNamePrefix": "[steps('webAppSettings').appServiceName]"

+# [Azure PowerShell](#tab/azure-powershell)

+After you create the storage account, add the role assignment _Storage Blob Data Contributor_ to the storage account scope. Assign access to your Microsoft Entra user account. Depending on your access level in Azure, you might need other permissions assigned by your administrator. For more information, see [Assign an Azure role for access to blob data](../../storage/blobs/assign-azure-role-data-access.md) and [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml).

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+| `packageFileUri` | Enter the URI for your _.zip_ package file. Use your `packageuri` variable's value. |

+# [Azure PowerShell](#tab/azure-powershell)

+You can use the following commands to verify that the managed application definition files are saved in your storage account's container.

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+# [Azure PowerShell](#tab/azure-powershell)

+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",

+ "defaultValue": "[resourceGroup().location]"

+ "appServicePlanName": {

+ "maxLength": 40,

+ "description": "App Service plan name."

+ }

+ "appServiceNamePrefix": {

+ "maxLength": 47,

+ "description": "App Service name prefix."

+ "appServicePlanSku": "B1",

+ "appServicePlanCapacity": 1,

+ "appServiceName": "[format('{0}{1}', parameters('appServiceNamePrefix'), uniqueString(resourceGroup().id))]",

+ "linuxFxVersion": "DOTNETCORE|8.0"

+ "apiVersion": "2023-01-01",

+ "name": "[parameters('appServicePlanName')]",

+ "name": "[variables('appServicePlanSku')]",

+ "capacity": "[variables('appServicePlanCapacity')]"

+ "kind": "linux",

+ "zoneRedundant": false,

+ "reserved": true

+ "apiVersion": "2023-01-01",

+ "name": "[variables('appServiceName')]",

+ "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]",

+ "httpsOnly": true,

+ "redundancyMode": "None",

+ "linuxFxVersion": "[variables('linuxFxVersion')]",

+ "minTlsVersion": "1.2",

+ "ftpsState": "Disabled"

+ }

+ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]"

+ "outputs": {

+ "appServicePlan": {

+ "type": "string",

+ "value": "[parameters('appServicePlanName')]"

+ },

+ "appServiceApp": {

+ "type": "string",

+ "value": "[reference(resourceId('Microsoft.Web/sites', variables('appServiceName')), '2023-01-01').defaultHostName]"

+ }

+ }

+ Title: About Azure CDN from Microsoft (classic) to Azure Front Door migration

+# About Azure CDN from Microsoft (classic) to Azure Front Door migration

+## Related content

+- [Use Call Diagnostics to diagnose call problems](./voice-video-calling/call-diagnostics.md)

+- [Use the UI Library for enhanced calling experiences](./ui-library/ui-library-overview.md)

+| Core capabilities | Join Teams for Work meeting [7] via URL | ✔️ |

+| | Join Teams for Work meeting [7] via meeting ID & passcode | ✔️ |

+| | Join Teams for Home meeting [7] | ❌ |

+1. If you are using Microsoft 365 work and school account then you use Teams for Work. If you schedule a meeting with this identity, the meeting's URL ends with `teams.microsoft.com`. If you are using personal account then you use Teams for Home. If you schedule a meeting with this identity, the meeting's URL ends with `teams.live.com`. Learn more about those accounts in our [documentation](https://support.microsoft.com/account-billing/what-s-the-difference-between-a-microsoft-account-and-a-work-or-school-account-72f10e1e-cab8-4950-a8da-7c45339575b0).

+ Title: Troubleshoot PSTN call failures - Azure Communication Services

+description: Learn how to troubleshoot PSTN call failures by logging and viewing call codes.

+# Troubleshoot Azure Communication Services PSTN call failures

+When you're troubleshooting Azure Communication Services PSTN call failures, we recommend that you [enable logging](../analytics/enable-logging.md). Then you can use `ResultCategories`, `ParticipantEndReason`, and `ParticipantEndSubCode` values to determine why an individual call ended and whether the system detected any failures.

+## Use ResultCategories to troubleshoot failures

+The `ResultCategories` array is a property of the [call summary log schema](../analytics/logs/voice-and-video-logs.md#call-summary-log-schema). It contains a list of general reasons that describe how the call ended:

+- `Success`

+- `Failure`

+- `UnexpectedClientError`

+- `UnexpectedServerError`

+This information can help you determine why a call ended without generating a detailed error log.

+## Use ParticipantEndReason and ParticipantEndSubCode to troubleshoot failures

+If the level of detail in `ResultCategories` isn't sufficient when you're troubleshooting PSTN calls, you can use `ParticipantEndReason` and `ParticipantEndSubCode` to understand the reasons why a call ended in greater detail. `ParticipantEndReason` and `ParticipantEndSubCode` are also properties of the [call summary log schema](../analytics/logs/voice-and-video-logs.md#call-summary-log-schema).

+### ParticipantEndReason

+`ParticipantEndReason` is a three-digit code that shows the general call status. This code explains why the call ended and groups failures by category. For example, `ParticipantEndReason 404` means that caller or callee wasn't found. `ParticipantEndReason 500` means that a service error occurred.

+This code is based on Session Initiation Protocol (SIP) response codes. For more information, see Wikipedia's [list of SIP response codes](https://en.wikipedia.org/wiki/List_of_SIP_response_codes).

+### ParticipantEndSubCode

+`ParticipantEndSubCode` is a more specific response code that's usually six digits long. It explains in greater detail why there was a problem with the call.

+A key factor in troubleshooting Azure Communication Services PSTN calls is determining whether the final SIP response code for the call came from a Microsoft process or the user's/operator's session border controller (SBC). An easy way to determine where the code originated is to look at the `ParticipantEndSubCode` response.

+If the `ParticipantEndSubCode` value starts with `560`, it indicates that the user's/operator's SBC generated the response code. In that case, you should check the SBC configuration.

+For example, if the `ParticipantEndSubCode` value is `560403`, it means that the SBC generated the final response code, and the code is `403`. In that case, you should start troubleshooting the calls by using the SBC logs.

+For `ParticipantEndSubCode` responses that don't start with `560`, the Microsoft service generated the final response code.

+## Related content

+- For general troubleshooting information, see [Troubleshooting in Azure Communication Services](../troubleshooting-info.md).

+- For detailed information about common error codes and suggested actions, see [Troubleshooting call end response codes for Calling SDK, Call Automation SDK, and PSTN calls](../../resources/troubleshooting/voice-video-calling/troubleshooting-codes.md).

+description: Learn how to use Call Diagnostics to diagnose call problems with Azure Communication Services.

+Azure Communication Services offers call quality analytics and visualizations in Call Diagnostics. You can use this feature to investigate call metrics, investigate events, and understand detected quality problems in your Communication Services calling solution.

+Understanding call quality and reliability is foundational to delivering a great customer experience. Various problems can affect the quality of calls, such as poor internet connectivity, software incompatibilities, and technical difficulties with devices. These problems can be frustrating for all call participants, whether they're a patient checking in for a doctor's call or a student taking a lesson with a teacher. For a developer, diagnosing and fixing these problems can be time-consuming.

+Call Diagnostics acts as a detective for calls. It helps developers who use Azure Communication Services to investigate events that happened in a call. The goal of the investigation is to identify likely causes of poor call quality and reliability.

+Just like a real conversation, many things happen simultaneously in a call that might or might not affect communication. The timeline in Call Diagnostics makes it easier to visualize what happened in a call. It shows you rich data visualizations of call events and provides insights into problems that commonly affect calls.

+## How to enable Call Diagnostics

+Azure Communication Services collects call data in the form of metrics and events. For Call Diagnostics to analyze new call data, you must enable a diagnostic setting in Azure Monitor. Azure Monitor then sends this data to a Log Analytics workspace.

+> [!IMPORTANT]

+> Call Diagnostics can query only data that's sent to a Log Analytics workspace. Diagnostic settings begin collecting data by a single Azure Communications Services resource ID after you enable the diagnostic setting.

+Because Call Diagnostics is an application layer on top of data for your Azure Communications Services resource, you can query the call data and [build workbook reports on top of your data](/azure/azure-monitor/logs/data-platform-logs#built-in-insights-and-custom-dashboards-workbooks-and-reports).

+You can access Call Diagnostics from any Azure Communication Services resource in the Azure portal. After you open your Azure Communications Services resource, look for the **Monitoring** section on the service menu and select **Call Diagnostics**.

+After you set up Call Diagnostics for your Azure Communication Services resource, you can search for calls by using valid IDs for calls that took place in that resource. Data can take several hours after call completion to appear in your resource and populate in Call Diagnostics.

+The following sections describe the main areas of the **Call Diagnostics** pane in the portal.

+## Call search

+The portal lists all calls by default. The search box lets you find individual calls, or filter calls to explore calls that have problems. Selecting a call takes you to a detail pane that has three tabs: **Overview**, **Issues**, and **Timeline**.

+You can search by call ID in the search box. To find a call ID, see [Access your client call ID](../troubleshooting-info.md#access-your-client-call-id).

+

+## Call overview

+After you select a call, its details appear on the **Overview** tab. This tab shows a call summary that highlights the participants and key metrics for their call quality. You can select a participant to drill into their call timeline details directly, or you can go to the **Issues** tab for further analysis.

+

+## Call issues

+The **Issues** tab gives you a high-level analysis of any media quality and reliability problems that Call Diagnostics detected during the call.

+This tab highlights detected problems commonly known to affect a user's call quality, such as poor network conditions, speaking while muted, or device failures. If you want to explore a detected problem, select the highlighted item. A prepopulated view of the related events appears on the **Timeline** tab.

+

+## Call timeline

+When call problems are difficult to troubleshoot, you can explore the **Timeline** tab to see a detailed sequence of events that occurred during the call.

+The timeline view is complex. It's designed for developers who need to explore details of a call and interpret detailed debugging data. In large calls, the timeline view can present an overwhelming amount of information. We recommend that you use filtering to narrow your search results and reduce complexity.

+You can view detailed call logs for each participant within a call. Call information might not be present for various reasons, such as privacy constraints between calling resources.

+

+AI can help app developers across every step of the development lifecycle: designing, building, and operating. Developers can use [Microsoft Copilot in Azure (preview)](/azure/copilot/overview) within Call Diagnostics to understand and resolve a variety of calling problems. For example, developers can ask Copilot in Azure these questions:

+- What are the common causes of poor media streams in Azure Communication Services calls?

+- The video on my call didn't work. How do I fix the subcode 41048?

+

+## Frequently asked questions

+### How do I set up Call Diagnostics?

+Follow instructions to add diagnostic settings for your resource in [Enable logs via Diagnostic Settings in Azure Monitor](../analytics/enable-logging.md). We recommend that you initially collect all logs. After you understand the capabilities in Azure Monitor, determine which logs you want to retain and for how long. When you add your diagnostic setting, you're prompted to [select logs](../analytics/enable-logging.md#adding-a-diagnostic-setting). To collect all logs, select **allLogs**.

+Your data volume, retention, and Call Diagnostics query usage in Log Analytics within Azure Monitor is billed through existing Azure data meters. We recommend that you monitor your data usage and retention policies for cost considerations as needed. For more information, see [Controlling costs](/azure/azure-monitor/essentials/diagnostic-settings#controlling-costs).

+If you have multiple Azure Communications Services resource IDs, you must enable these settings for each resource ID and query call details for participants within their respective resource IDs.

+Participants who join from other Azure Communication Services resources have limited information in Call Diagnostics. The participants who belong to the resource when you open Call Diagnostics have all available insights shown.

+### What are the common call problems I might see, and how can I fix them?

+Here are resources for common call problems:

+- For an overview of troubleshooting strategies and for more information on isolating call problems, see [Overview of general troubleshooting strategies](../../resources/troubleshooting/voice-video-calling/general-troubleshooting-strategies/overview.md).

+- For descriptions of common error messages, see [Understanding error messages and codes](../../resources/troubleshooting/voice-video-calling/general-troubleshooting-strategies/understanding-error-codes.md).

+- If users can't join calls, see [Overview of call setup issues](../../resources/troubleshooting/voice-video-calling/call-setup-issues/overview.md).

+- If users have camera or microphone problems (for example, they can't hear someone), see [Overview of device and permission issues](../../resources/troubleshooting/voice-video-calling/device-issues/overview.md).

+- If call participants have audio problems (for example, they sound like a robot or hear an echo), see [Overview of audio issues](../../resources/troubleshooting/voice-video-calling/audio-issues/overview.md).

+- If call participants have video problems (for example, their video looks fuzzy or cuts in and out), see [Overview of video issues](../../resources/troubleshooting/voice-video-calling/video-issues/overview.md).

+### How do I use Copilot in Azure (preview) in Call Diagnostics?

+Your organization manages access to [Microsoft Copilot in Azure (preview)](/azure/copilot/overview). After your organization has access to Copilot in Azure, the Call Diagnostics interface includes the **Diagnose with Copilot** option in the search area, on the **Overview** tab, and on the **Issues** tab.

+Use Copilot in Azure for Call Diagnostics to improve call quality by detailing problems faced during Azure Communication Services calls. Giving Copilot in Azure detailed information from Call Diagnostics will help it enhance analysis, identify problems, and identify fixes. Be aware that Copilot in Azure currently lacks programmatic access to your call details.

+## Related content

+- Learn how to manage call quality: [Improve and manage call quality](manage-call-quality.md).

+- Explore troubleshooting guidance: [Overview of audio issues](../../resources/troubleshooting/voice-video-calling/audio-issues/overview.md).

+- Learn about other quality best practices: [Best practices: Azure Communication Services calling SDKs](../best-practices.md).

+- Learn how to use the Log Analytics workspace: [Log Analytics tutorial](/azure/azure-monitor/logs/log-analytics-tutorial).

+- Create your own queries in Log Analytics: [Get started with log queries in Azure Monitor](/azure/azure-monitor/logs/get-started-queries).

+- Explore known call issues: [Known issues in the SDKs and APIs](../known-issues.md).

+The End of Call Survey is a tool that helps you understand how your users perceive the overall quality and reliability of your Calling SDK solution.

+It's difficult to determine a customer's perceived calling experience and understand how well your calling solution is performing unless you gather feedback. You can use the End of Call Survey to collect and analyze customers' *subjective* opinions on their calling experience. Relying only on *objective* measurements, such as audio and video bitrate, jitter, and latency, might not indicate if a customer had a poor calling experience.

+After you publish survey data, you can view the survey results through Azure for analysis and improvements. Azure Communication Services uses these survey results to monitor and improve quality and reliability.

+The survey is designed to answer two questions:

+- How did the user perceive the overall experience of call quality?

+- Did the user perceive any problems with audio, video, or screen sharing in the call?

+The API enables applications to gather data points that describe user-perceived ratings of their overall call, audio, video, and screen-sharing experiences. Microsoft analyzes survey API results according to the following goals.

+| API rating category | Question goal |

+| Overall call | Responses indicate how a call participant perceived overall call quality. |

+| Audio | Responses indicate if the user perceived any audio problems. |

+| Video | Responses indicate if the user perceived any video problems. |

+| Screen sharing | Responses indicate if the user perceived any screen-sharing problems. |

+| API rating category | Cutoff value | Input range | Comments |

+| -- | -- | -- | -- |

+| Overall call | 2 | 1 - 5 | Surveys a calling participant's overall quality experience on a scale of 1 to 5. A response of 1 indicates an imperfect call experience. A response of 5 indicates a perfect call. The cutoff value of 2 means that a response of 1 or 2 indicates a less-than-perfect call experience. |

+| Audio | 2 | 1 - 5 | A response of 1 indicates an imperfect audio experience. A response of 5 indicates that the customer experienced no audio problems. |

+| Video | 2 | 1 - 5 | A response of 1 indicates an imperfect video experience. A response of 5 indicates that the customer experienced no video problems. |

+| Screen sharing | 2 | 1 - 5 | A response of 1 indicates an imperfect screen-sharing experience. A response of 5 indicates that the customer experienced no screen-sharing problems. |

+> [!NOTE]

+> A question's indicated cutoff value in the API is the threshold that Microsoft uses when analyzing your survey data. When you customize the cutoff value or input range, Microsoft analyzes your survey data according to your customizations.

+| Rating category | Optional tags |

+| Overall call | `CallCannotJoin` `CallCannotInvite` `HadToRejoin` `CallEndedUnexpectedly` `OtherIssues` |

+| Screen sharing | `NoContentLocal` `NoContentRemote` `CannotPresent` `LowQuality` `Freezes` `StoppedUnexpectedly` `LargeDelay` `OtherIssues` |

+### End of Call Survey customization options

+You can choose to collect all of the four API values or only the ones that you find most important. For example, you can choose to ask customers about only their overall call experience and not ask about their audio, video, and screen-sharing experience.

+You can also customize input ranges to suit your needs. The default input range is 1 to 5 for overall call, audio, video, and screen sharing. However, you can customize each API value from a minimum of 0 to maximum of 100.

+| API rating category | Cutoff value | Input range |

+| Overall call | 0 - 100 | 0 - 100 |

+| Audio | 0 - 100 | 0 - 100 |

+| Video | 0 - 100 | 0 - 100 |

+| Screen sharing | 0 - 100 | 0 - 100 |

+## Storage of survey data for viewing

+To send the log data of your surveys to a Log Analytics workspace, an Azure Event Hubs instance, or an Azure storage account for analysis, you must enable a diagnostic setting in Azure Monitor. If you don't enable a diagnostic setting to send survey data to one of these options, your survey data won't be stored and will be lost.

+To enable logs for Communications Services, see [End of Call Survey logs](../analytics/logs/end-of-call-survey-logs.md).

+## Related content

+- Learn how to use the End of Call Survey: [Use the End of Call Survey to collect user feedback](../../tutorials/end-of-call-survey-tutorial.md).

+- Analyze your survey data: [End of Call Survey logs](../analytics/logs/end-of-call-survey-logs.md).

+- Learn how to use the Log Analytics workspace: [Log Analytics tutorial](/azure/azure-monitor/logs/log-analytics-tutorial).

+- Create your own queries in Log Analytics: [Get started with log queries in Azure Monitor](/azure/azure-monitor/logs/get-started-queries).

+ Title: Azure Communication Services Manage Call Quality

+description: Learn how to improve and manage call quality with Azure Communication Services.

+This article introduces key tools that you can use to monitor, troubleshoot, and improve call quality in Azure Communication Services. The following materials help you plan for the best user experience.

+Before you read this article, become familiar with overview information about calling:

+- Voice and video calling: [Azure Communication Services Calling SDK overview](calling-sdk-features.md)

+- Phone calling: [Public Switched Telephone Network (PSTN) integration concepts](../telephony/telephony-concept.md)

+## Prepare your network and prioritize important network traffic by using QoS

+As your users start using Azure Communication Services for calls and meetings, they might experience a caller's voice breaking up or cutting in and out of a call or meeting. Shared video might freeze, or pixelate, or fail altogether. This problem is due to the IP packets that represent voice and video traffic encountering network congestion and arriving out of sequence or not at all. If it happens (or to prevent it from happening in the first place), use Quality of Service (QoS) by following the [network recommendations](network-requirements.md).

+With QoS, you prioritize delay-sensitive network traffic (for example, voice or video streams). You allow that traffic to "cut in line" in front of traffic that's less sensitive. An example of lower-priority traffic is downloading a new app. In that case, an extra second to download isn't a significant problem.

+QoS identifies and marks all packets in real-time streams by using Windows Group Policy objects and a routing feature called Port-based Access Control Lists. That feature instructs your network to give voice, video, and screen sharing their own dedicated network bandwidth.

+Ideally, you implement QoS on your internal network while getting ready to roll out your Azure Communication Services solution. But you can do it anytime. If your network is small enough, you might not need QoS.

+For detailed guidance, see [Network optimization](network-requirements.md#network-optimization).

+Quality has different definitions, depending on the real-time communication use case and the perspective of the users. Many variables affect the perceived quality of a real-time calling experience. An improvement in one variable might cause a negative change in another variable. For example, increasing the frame rate and resolution of a video call increases network bandwidth utilization and processing power.

+Determine your customer's use cases and requirements before you start your development. For example, a customer who needs to monitor dozens of security camera feeds simultaneously might not need the maximum resolution and frame rate that each video stream can provide. In this scenario, you could use the [Video Constraints API](video-constraints.md) capability to limit the amount of bandwidth that each video stream uses.

+## Implement logging on native platforms

+Implementing logging as described in the [tutorial about retrieving log files](../../tutorials/log-file-retrieval-tutorial.md) is critical to gathering details for native development. Detailed logs help in diagnosing problems specific to device models or OS versions. We encourage developers who start configuring the Logs API to get details about the call lifetime.

+We recommend that you use [these easy-to-implement calling samples](../../overview.md#samples), because they're already optimized to give your users the best call quality.

+If the samples don't meet your needs and you decide to customize your Azure Communication Services calling solution, implement the following capabilities to support a high-quality calling experience. The tools for these capabilities help prevent common quality and reliability problems from happening and diagnose problems if they occur. Keep in mind that some call data isn't created or stored unless you implement these capabilities.

+The following sections detail the tools to implement at the phases of a call:

+- **Before a call**: Pre-call readiness.

+- **During a call**: In-call communication.

+- **After a call**: Monitoring and troubleshooting call quality and reliability.

+### Before a call

+By using the pre-call checks that Azure Communication Services provides, you can learn a user's connection status before the call and take proactive action on their behalf. For example, if you learn that a user's connection is poor, you can suggest that they turn off their video before joining the call to have a better audio connection.

+#### Network Diagnostic tool

+The Network Diagnostic tool provides a hosted experience for developers to validate call readiness during development. You can check if a user's device and network conditions are optimal for connecting to the service, to help ensure a great call experience. The tool performs diagnostics on the network, devices, and call quality.

+By using the Network Diagnostic tool, you can encourage users to resolve reliability problems and improve their network connection before they join a call.

+For more information, see [Network Diagnostic tool](../developer-tools/network-diagnostic.md).

+##### Pre-Call API for diagnostics

+Maybe you want to build your own diagnostic tool or perform a deeper integration of the Network Diagnostic tool into your application. If so, you can use the Pre-Call API to run the diagnostic tool for the Calling SDK.

+The Pre-Call API lets you customize the experience in your user interface. You can then run the same series of tests that the Network Diagnostic tool uses to ensure compatibility, connectivity, and device permissions with a test call. You can decide the best way to tell users how to correct problems before calls begin. You can also perform specific checks when troubleshooting quality and reliability problems.

+For example, if a user's hardware test has a problem, you can notify the user to manage expectations and changes for future calls.

+For more information, see [Pre-Call diagnostic](pre-call-diagnostics.md).

+#### Conflicting call clients

+Because Azure Communication Services voice and video calls run on web and mobile browsers, your users might have multiple browser tabs running separate instances of the Azure Communication Services Calling SDK. This situation can happen for various reasons, like these examples:

+- The user forgot to close a previous tab.

+- The user couldn't join a call without a meeting organizer present. The user reattempts to select the link for joining the meeting, which opens a separate mobile browser tab.

+Having multiple call browser tabs at the same time causes disruptions to audio and video behavior on the call that the user is trying to join (that is, the *target call*). You should make sure that multiple browser tabs aren't open before a call starts and (through monitoring) during the whole life cycle of the call. You can proactively notify customers to close their excess tabs, or help them join a call correctly with useful messaging if they initially can't join a call.

+To check if user has multiple instances of Azure Communication Services running in a browser, see [How to detect if an application using the Azure Communication Services SDK is active in multiple tabs of a browser](../../how-tos/calling-sdk/is-sdk-active-in-multiple-tabs.md).

+### During a call

+During a call, a user's network conditions can worsen, or they might run into reliability and compatibility problems. Those situations can result in a poor calling experience. The following sections help you apply capabilities to manage problems in a call and communicate with your users.

+#### User Facing Diagnostics

+When a user is in a call, it's important to notify them in real time about problems on their call. The User Facing Diagnostics feature provides real-time flags for problems that affect the user, such as having their microphone muted while talking or having a poor network quality.

+You can tailor your user interface messages to best suit your scenarios. For example:

+- If a flag identifies a network problem, you can prompt users to turn off their video, change networks, or move to a location that has a better network condition or connection.

+- If a flag identifies a device problem, you can nudge the user to switch devices.

+In addition to messaging, you can act on users' behalf and consider proactive approaches to protect the limited bandwidth that a user has. If you find that users don't consistently turn off their video after receiving a notification from you, you can proactively turn off a user's video to prioritize their audio connection. You can even hide video capability from customers in your user interface before they join a call.

+For more information, see [User Facing Diagnostics](user-facing-diagnostics.md).

+#### Video constraints

+Video streams consume large amounts of network bandwidth. If you know that your users have limited network bandwidth or poor network conditions, you can control the network usage of a user's video connection by using video constraints. When you limit the amount of bandwidth that a user's video stream can consume, you can protect the bandwidth needed for good audio quality in poor network environments.

+To learn more, see [Video constraints](video-constraints.md).

+#### Volume indicator

+Sometimes users can't hear each other. Maybe the speaker is too quiet, the listener's device doesn't receive the audio packets, or an audio device problem is blocking the sound. Users don't know when the other person can't hear them. You can use the input and output indicator to:

+1. Indicate if a user's volume is low or absent.

+1. Prompt the user to speak louder or investigate an audio device problem through your user interface.

+For more information, see the [quickstart about adding a volume indicator to web calling](../../quickstarts/voice-video-calling/get-started-volume-indicator.md).

+#### Media quality statistics

+Because network conditions can change during a call, users can report poor audio and video quality even if they started the call without any problems. The *media quality statistics* feature gives you detailed quality metrics on each inbound and outbound audio, video, and screen-share stream. These detailed insights help you monitor calls in progress, show users their network quality status throughout a call, and debug individual calls.

+The metrics in this feature help indicate problems on the Azure Communication Services Client SDK media streams for sending and receiving. As an example, you can actively monitor the outgoing video stream's `availableBitrate` value, notice a persistent drop below the recommended 1.5 Mbps, and notify the user that the video quality is degraded.

+Server log data gives you only a general summary of the call after it ends. The detailed media statistics provide low-level metrics throughout the call duration and afterward for deeper analysis.

+To learn more, see [Media quality statistics](media-quality-sdk.md).

+#### Optimal Video Count API

+During a group call with two or more participants, a user's video quality can fluctuate due to changes in network conditions and their specific hardware limitations. By using the Optimal Video Count API, you can improve a user's call quality by understanding how many video streams their local endpoint can render at a time without worsening quality.

+By implementing this feature, you can preserve the call quality and bandwidth of local endpoints that would otherwise attempt to render video poorly. The API exposes the property `optimalVideoCount`, which dynamically changes in response to the network and hardware capabilities of a local endpoint. This information is available at runtime and gets updates throughout the call, so you can adjust a user's visual experience as network and hardware conditions change.

+To implement this feature, see the web platform guidance [Manage video during calls](/azure/communication-services/how-tos/calling-sdk/manage-video?pivots=platform-web#remote-video-quality).

+### After a call

+Before you release and scale your Azure Communication Services calling solution, implement the following monitoring capabilities for quality and reliability to ensure that you're collecting available logs and metrics. The call data isn't stored until you implement the capabilities, so you can't monitor and debug your call quality and reliability without them.

+For more information, see [Azure Communication Services Voice Calling and Video Calling logs](../analytics/logs/voice-and-video-logs.md).

+#### Start collecting call logs

+To view and analyze the data in Azure Monitor, we recommend that you choose the category group **allLogs** and choose the destination detail of **Send to Log Analytics workspace**. If you don't have a Log Analytics workspace to send your data to, [create one](/azure/azure-monitor/logs/quick-create-workspace).

+We recommend that you monitor your data usage and retention policies for cost considerations as needed. For more information, see [Controlling costs](/azure/azure-monitor/essentials/diagnostic-settings#controlling-costs).

+#### Diagnose calls by using Call Diagnostics

+Call Diagnostics is an Azure Monitor experience that delivers tailored insights through specialized telemetry and diagnostic pages in the Azure portal.

+After you begin storing log data in your Log Analytics workspace, you can visualize your search for individual calls and visualize the data in Call Diagnostics. In your Azure Monitor account, go to your Azure Communication Services resource and locate **Call Diagnostics** on the service menu. To learn how to best use this capability, see [Call Diagnostics](call-diagnostics.md).

+#### Examine call quality by using voice and video insights

+After you enable logs, you can view call insights in your Azure resource by using the visualization examples in [Voice and video insights](../analytics/insights/voice-and-video-insights.md).

+You can modify the existing workbooks or even create your own. For more information, see [Azure Workbooks](/azure/azure-monitor/visualize/workbooks-overview).

+For examples of deeper suggested analysis, see [Query call logs](../analytics/query-call-logs.md).

+#### Analyze user sentiment by using the End of Call Survey

+Customer feedback is invaluable. The End of Call Survey helps you understand how your users perceive the overall quality and reliability of your JavaScript or Web SDK calling solution.

+You can modify the survey to various formats if you already have a survey solution in place. After you publish survey data, you can view the results in Azure Monitor for analysis and improvements. Azure Communication Services also uses the Survey API results to monitor and improve call quality and reliability.

+To implement the feature, see [Tutorial: Use the End of Call Survey to collect user feedback](../../tutorials/end-of-call-survey-tutorial.md). After you enable diagnostic settings to capture your survey data, you can use [sample call log queries](../analytics/query-call-logs.md) in Azure Log Analytics to analyze your user's perceived quality experience. User feedback can show you call problems you didn't know you had and help you prioritize your quality improvements.

+To learn more, see [End of Call Survey overview](end-of-call-survey-concept.md).

+#### Analyze your call data directly from the client

+By collecting call data such as media statistics, User Facing Diagnostics, and Pre-Call API information, you can review poor-quality calls to conduct root-cause analysis when you're troubleshooting problems.

+For example, a user might have an hour-long call and report poor audio at one point in the call. The call might have fired a User Facing Diagnostic flag that indicated a severe problem with the quality of an incoming or outgoing media stream.

+By storing the [detailed media statistics](media-quality-sdk.md) from the call, you can review when the User Facing Diagnostics flag occurred to see if high levels of packet loss, jitter, or latency around this time indicate a poor network condition. For example, you can explore whether the network was affected by an external client's unmanaged network, unnecessary network traffic due to improper QoS network prioritization policies, or an unnecessary virtual private network (VPN).

+> [!NOTE]

+> As a rule, we recommend prioritizing the bandwidth of a user's audio connection before their video connection. We recommend prioritizing both audio and video before other network traffic. When a network can't support both audio and video, you can proactively disable a user's video or nudge a user to disable their video.

+#### Request support

+If you encounter quality or reliability problems that you can't resolve, you can submit a request for technical support. The more information you can provide in your request, the better. (Native logs are crucial to optimize the response time.) However, you can still submit requests with partial information to start your inquiry. For more information, see [Create an Azure support request](/azure/azure-portal/supportability/how-to-create-azure-support-request).

+If you're notified of license requirements while you're trying to request technical support, you might need to choose a paid Azure support plan that best aligns to your needs. See [Compare support plans](https://azure.microsoft.com/support/plans).

+If you prefer not to purchase support, you can take advantage of community support. See [Azure Community Support](https://azure.microsoft.com/support/community/).

+#### Other considerations

+If you don't have access to your customer's Azure portal to view data tied to their Azure resource ID, you can request to query their workspaces to improve quality on their behalf. For more information, see [Query data across Log Analytics workspaces, applications, and resources in Azure Monitor](/azure/azure-monitor/logs/cross-workspace-query).

+## Related content

+- Learn other best practices: [Best practices: Azure Communication Services calling SDKs](../best-practices.md).

+- Explore known issues: [Known issues in the SDKs and APIs](../known-issues.md).

+- Learn how to debug calls: [Call Diagnostics](call-diagnostics.md).

+- Learn how to use the Log Analytics workspace: [Log Analytics tutorial](/azure/azure-monitor/logs/log-analytics-tutorial).

+- Create your own queries: [Get started with log queries in Azure Monitor](/azure/azure-monitor/logs/get-started-queries).

+# Troubleshoot VoIP call quality

+This article describes how to troubleshoot and improve web Voice over Internet Protocol (VoIP) call quality in Azure Communication Services.

+Voice and video calling experiences are an essential communication tool for businesses, organizations, and individuals in today's world. However, customers can experience quality problems. Four network parameters can affect quality in calls: available bandwidth, round-trip time (RTT), packet loss, and jitter.

+If quality problems arise with VoIP calling in Azure Communication Services, follow the troubleshooting guidance in this article to ensure the best-possible user experience.

+## Network conditions that can cause quality problems

+The following conditions can happen with audio during a call.

+### Choppy or robotic-sounding audio

+When call audio sounds choppy, sounds robotic, or cuts in and out, the reason might be by packet loss due to excessive jitter on the line. *Jitter* means that packets are received out of order. Several factors can cause it, including network traffic or the technologies used in the call.

+### One-way or missing audio

+When a caller can hear the other party, but the other party can't hear the caller, we refer to this condition as *one-way audio*. Several factors can cause missing audio streams, including errors in the connection or handshake, problems during a network handoff, or problems at the source or destination.

+### Delayed audio

+When caller or callee reports excessive delays in the call audio, the reason can be excessive latency on the line. Several factors can cause audio latency, including delayed packet transmission or delivery somewhere along the line, or the technologies used in the call.

+### Audio echo

+When a caller or callee reports that they hear their own delayed audio being transmitted back to them, we refer to this condition as *audio echo*. The causes of echo can be positioning and volume levels of the speaker and/or microphone at one end of the line, or crosstalk on copper wire (landline) networks.

+### Audio volume problem

+When a caller or callee reports that the volume of a call is either too loud or too quiet, we typically classify this condition as an audio volume problem. The cause is often the hardware, including the positioning and volume levels of the speaker and/or microphone at one end of the line. If the input and output indicator shows that the user's volume is low, you can prompt the user to speak louder.

+For more information, see [Access call volume level in your calling app](../../quickstarts/voice-video-calling/get-started-volume-indicator.md).

+### Static

+When a caller or callee reports audio interference or background noise on a call, we typically classify this condition as an audio static problem. The cause can be the hardware in use, including the placement, positioning, and levels of the speaker and/or microphone at one end of the line.

+Also, make sure that the application you're using for web calling is hosted on the latest SDK. For more information, see [Azure Communication Services Calling Web (JavaScript) SDK - Release History](https://github.com/Azure/Communication/blob/master/releasenotes/acs-javascript-calling-library-release-notes.md).

+## Pre-call checkups

+When you're using the internet at various locations, you experience different internet speeds. Factors like the following examples can affect internet speed and reliability:

+- At home: the type of internet connection, the quality of the router, and the number of devices connected to the network.

+- In the office: the number of users on the network, the quality of the network infrastructure, and the type of internet connection.

+- When you're using cellular data: the strength of the cellular signal, the distance from the cell tower, and the number of users on the network. Additionally, some cellular plans have data caps or throttling.

+Because of this variability, it's important to test the network connection and settings of your machine. You can run a network diagnostic check by using the [Azure Communication Services Network Diagnostic tool](https://azurecommdiagnostics.net/). This tool checks all the essential parameters to help you determine if the network connection at your local machine is compatible with Azure Communication Services. You can also run this tool on mobile devices. For more information about network quality, bandwidth, configuration, and optimization, see [Network recommendations](network-requirements.md).

+You can also take advantage of these features in Azure Communication

+- Enable logging via [diagnostic settings in Azure Monitor](../analytics/enable-logging.md). You can then view [call insights in your Azure resource](../analytics/insights/voice-and-video-insights.md).

+- Improve audio quality in poor network environments by using [video constraints](video-constraints.md) to reduce the bandwidth that users of video streams consume.

+- Programmatically validate a client's readiness to join an Azure Communication Services call by using the [Pre-Call API](pre-call-diagnostics.md). You access this API through the Calling SDK. It provides multiple diagnostics, including device, connection, and call quality. This feature is currently available only for the web (JavaScript).

+## Mid-call checkups

+You can enable these Azure Communication Services features in web calling applications:

+- [User Facing Diagnostics](user-facing-diagnostics.md): This feature helps users see what's wrong with a call, such as an unreliable network connection or a microphone that isn't responding.

+- [Media quality statistics](media-quality-sdk.md): You can use this feature to debug and troubleshoot quality-related problems with Azure Communication Services calls. Media statistics include factors like RTT, bitrates, packet loss, and jitter. Media statistics help engineers better understand the problem and the exact timing.

+Sometimes users have instances of Azure Communication Services running on multiple browser tabs. This situation can disrupt audio and video behavior on the target call. You can detect if a user has multiple instances running in a browser. For more information, see [How to detect if an application using the Azure Communication Services SDK is active in multiple tabs of a browser](../../how-tos/calling-sdk/is-sdk-active-in-multiple-tabs.md).

+## Post-call checkups

+You can check the log insights from the Azure portal to determine the exact problem during the call. For more information, see [Query call logs](../analytics/query-call-logs.md).

+If you tried all the previous actions and still face quality problems, [create an Azure support request](/azure/azure-portal/supportability/how-to-create-azure-support-request). If necessary, Microsoft can run a network check for your tenant to help ensure call quality.

+## End of Call Survey

+Enable the End of Call Survey feature to give Azure Communication Services users the option to submit qualitative feedback about their call experience.

+For more information, see [End of Call Survey overview](end-of-call-survey-concept.md) and the related tutorial [Use the End of Call Survey to collect user feedback](../../tutorials/end-of-call-survey-tutorial.md).

+## Related content

+- For information about using Call Quality Dashboard (CQD) to view interoperability call logs, see [Use CQD to manage call and meeting quality in Microsoft Teams](/microsoftteams/quality-of-experience-review-guide).

+- For information about Calling SDK error codes, see [Troubleshooting in Azure Communication Services](../../resources/troubleshooting/voice-video-calling/troubleshooting-codes.md). Use these codes to help determine why a call ended.

+- To ensure smooth functioning of the application and provide better user experience, app developers should follow a checklist. For more information, see the blog post [Checklist for advanced calling experiences in web browsers](https://techcommunity.microsoft.com/t5/azure-communication-services/checklist-for-advanced-calling-experiences-in-web-browsers/ba-p/3266312).

+- For more information about preparing your network or your customer's network, see [Network recommendations](network-requirements.md).

+- For best practices regarding Azure Communication Services web calling, see [Best practices: Azure Communication Services calling SDKs](../best-practices.md).

+ Title: Azure Communication Services Video Constraints

+description: Get an overview of the Video Constraints API.

+# Video Constraints

+The Video Constraints API enables developers to control the video quality from within video calls. With this API, developers can set maximum video resolutions, frame rate, and bitrate so that the call is optimized for the user's device and network conditions.

+The Azure Communication Services video engine is optimized to allow the video quality to change dynamically based on a device's ability and the network quality. But there might be certain scenarios where the highest video quality isn't a priority, or you want to limit the video bandwidth usage in an application. To support those use cases, you can use the Video Constraints API to have tighter control over the video quality that users experience.

+Another benefit of the Video Constraints API is that it enables developers to optimize the video call for different devices. For example, if a user is using an older device with limited processing power, you can set constraints on the video resolution to ensure that the video call runs smoothly on that device.

+| Platform | Supported constraints |

+| **Web** | **Incoming video**: resolution<br />**Outgoing video**: resolution, frame rate, bitrate |

+| **Android** | **Incoming video**: resolution<br />**Outgoing video**: resolution, frame rate |

+| **iOS** | **Incoming video**: resolution<br />**Outgoing video**: resolution, frame rate |

+| **Windows** | **Incoming video**: resolution<br />**Outgoing video**: resolution, frame rate |

+## Related content

+- [Quickstart: Set video constraints in your calling app](../../quickstarts/voice-video-calling/get-started-video-constraints.md)

+- [Enable media quality statistics in your application](./media-quality-sdk.md)

+- [Quickstart: Add voice calling to your app](../../quickstarts/voice-video-calling/getting-started-with-calling.md)

+- Review the [requirements and limitations](azure-arc-overview.md) of the public preview. Of particular importance are the cluster requirements.

+> [!IMPORTANT]

+> If deploying onto **AKS-HCI** ensure that you have [setup HAProxy as your load balancer](/azure/aks/hybrid/configure-load-balancer) before attempting to install the extension.

+| Node OS requirement | **Linux** only. |

+> [!IMPORTANT]

+> If deploying onto **AKS-HCI** ensure that you have [setup HAProxy as your load balancer](/azure/aks/hybrid/configure-load-balancer) before attempting to install the extension.

+- [Can the extension be installed on Windows nodes?](#can-the-extension-be-installed-on-windows-nodes)

+## Can the extension be installed on Windows nodes?

+No, the extension cannot be installed on Windows nodes. The extension supports installation on **Linux** nodes **only**.

+- Optional [sidecar](#sidecar-containers) and [init](#init-containers) containers

+- Apps use the `template` configuration section to define the container image and other settings. Changes to the `template` configuration section trigger a new [container app revision](application-lifecycle-management.md).

+- **Maximum image size**:

+ - Consumption workload profile supports container images totaling up to 8GB for each app or job replica.

+ - Dedicated workload profiles support larger container images. Because a Dedicated workload profile can run multiple apps or jobs, multiple container images share the available disk space. The actual supported image size varies based on resources consumed by other apps and jobs.

+| Title | Dimensions | Description | Metric ID | Unit |

+| CPU Usage | Replica, Revision | CPU consumed by the container app, in nano cores (1,000,000,000 nanocores = 1 core) | `UsageNanoCores` | nanocores |

+| Memory Working Set Bytes | Replica, Revision | Container app working set memory used in bytes | `WorkingSetBytes` | bytes |

+| Network In Bytes | Replica, Revision | Network received bytes | `RxBytes` | bytes |

+| Network Out Bytes | Replica, Revision | Network transmitted bytes | `TxBytes` | bytes |

+| Replica count | Revision | Number of active replicas | `Replicas` | n/a |

+| Replica Restart Count | Replica, Revision | Restarts count of container app replicas | `RestartCount` | n/a |

+| Requests | Replica, Revision, Status Code, Status Code Category | Requests processed | `Requests` | n/a |

+| Reserved Cores | Revision | Number of reserved cores for container app revisions | `CoresQuotaUsed` | n/a |

+| Resiliency Connection Timeouts | Revision | Total connection timeouts | `ResiliencyConnectTimeouts` | n/a |

+| Resiliency Ejected Hosts | Revision | Number of currently ejected hosts | `ResiliencyEjectedHosts` | n/a |

+| Resiliency Ejections Aborted | Revision | Number of ejections aborted due to the max ejection % | `ResiliencyEjectionsAborted` | n/a |

+| Resiliency Request Retries | Revision | Total request retries | `ResiliencyRequestRetries` | n/a |

+| Resiliency Request Timeouts | Revision | Total requests that timed out waiting for a response | `ResiliencyRequestTimeouts` | n/a |

+| Resiliency Requests Pending Connection Pool | Replica | Total requests pending a connection pool connection | `ResiliencyRequestsPendingConnectionPool` | n/a |

+| Total Reserved Cores | None | Total cores reserved for the container app | `TotalCoresQuotaUsed` | n/a |

+| servicePrincipalCredentialType | Specify the credential type to use for service principal authentication. Allowed values are `ServicePrincipalCert` and `ServicePrincipalKey`. | No |

+| servicePrincipalEmbeddedCert | Specify the base64 encoded certificate of your application registered in Microsoft Entra ID, and ensure the certificate content type is **PKCS #12**. Mark this field as a **SecureString** to store it securely, or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). You need to configure the permission settings referring this [article](/sharepoint/dev/solution-guidance/security-apponly-azuread).| No |

+| ***For ServicePrincipalKey*** | | |

+| servicePrincipalKey | The application's key. Mark this field as a **SecureString** to store it securely, or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). Refer to this [section](#grant-permission-for-using-service-principal-key) for more details including the permission settings.| No |

+>[!Note]

+>If you are using service principal key authentication, which is based on Azure ACS (Access Control Services), we recommend switching to the **service principal certificate authentication** due to the [ACS retirement plan](/sharepoint/dev/sp-add-ins/retirement-announcement-for-azure-acs).

+| [kcat](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/quickstart/kafkacat) | kcat is a non-JVM command-line consumer and producer based on librdkafka, popular due to its speed and small footprint. This quickstart contains a sample configuration and several simple sample kafkacat commands. |

+| **Amsterdam** | [Equinix AM5](https://www.equinix.com/locations/europe-colocation/netherlands-colocation/amsterdam-data-centers/am5/) | 1 | West Europe | &check; | Aryaka Networks<br/>AT&T NetBond<br/>British Telecom<br/>Colt<br/>China Unicom Global<br/>Deutsche Telekom AG<br/>Equinix<br/>euNetworks<br/>GÉANT<br/>GlobalConnect<br/>InterCloud<br/>Interxion (Digital Realty)<br/>KPN<br/>IX Reach<br/>Level 3 Communications<br/>Megaport<br/>NTT Communications<br/>Orange<br/>Tata Communications<br/>Telecom Italia Sparkle<br/>Telefonica<br/>Telenor<br/>Telia Carrier<br/>Verizon<br/>Zayo |

+| **Chicago2** | [CoreSite CH1](https://www.coresite.com/data-center/ch1-chicago-il) | 1 | North Central US | &check; | CoreSite<br/>DE-CIX<br/>Megaport<br/>Momentum Telecom |

+| **Dallas2** | [Digital Realty DFW10](https://www.digitalrealty.com/data-centers/americas/dallas/dfw10) | 1 | &cross; | &check; | Digital Realty<br/>Momentum Telecom |

+| **Denver** | [CoreSite DE1](https://www.coresite.com/data-centers/locations/denver/de1) | 1 | West Central US | &check; | CoreSite<br/>Megaport<br/>Momentum Telecom<br/>PacketFabric<br/>Zayo |

+| **Jakarta** | [Telin](https://www.telin.net/) | 4 | &cross; | &check; | DCI Indonesia<br/>DE-CIX<br/>NTT Communications<br/>NTT Indonesia<br/>Telin<br/>XL Axiata |

+| **London** | [Equinix LD5](https://www.equinix.com/locations/europe-colocation/united-kingdom-colocation/london-data-centers/ld5/) | 1 | UK South | &check; | AT&T NetBond<br/>Bezeq International<br/>British Telecom<br/>CenturyLink<br/>Colt<br/>Equinix<br/>euNetworks<br/>Intelsat<br/>InterCloud<br/>Internet Solutions - Cloud Connect<br/>Interxion (Digital Realty)<br/>Jisc<br/>Level 3 Communications<br/>Megaport<br/>Momentum Telecom<br/>MTN<br/>NTT Communications<br/>Orange<br/>PCCW Global Limited<br/>Tata Communications<br/>Telehouse - KDDI<br/>Telenor<br/>Telia Carrier<br/>Verizon<br/>Vodafone<br/>Zayo |

+| **London2** | [Telehouse North Two](https://www.telehouse.net/data-centres/emea/uk-data-centres/london-data-centres/north-two) | 1 | UK South | &check; | BICS<br/>British Telecom<br/>CenturyLink Cloud Connect<br/>Colt<br/>Equinix<br/>Epsilon Global Communications<br/>GTT<br/>Interxion (Digital Realty)<br/>IX Reach<br/>JISC<br/>Megaport<br/>NTT Global DataCenters EMEA<br/>Ooredoo Cloud Connect<br/>Orange<br/>SES<br/>Sohonet<br/>Tata Communications<br/>Telehouse - KDDI<br/>Zayo<br/>Vodafone |

+| **Los Angeles** | [CoreSite LA1](https://www.coresite.com/data-centers/locations/los-angeles/one-wilshire) | 1 | &cross; | &check; | AT&T Dynamic Exchange<br/>CoreSite<br/>China Unicom Global<br/>Cloudflare<br/> Megaport<br/>Momentum Telecom<br/>Neutrona Networks<br/>NTT<br/>Zayo</br></br> |

+| **Madrid** | [Interxion MAD1](https://www.interxion.com/es/donde-estamos/europa/madrid) | 1 | &cross; | &check; | DE-CIX<br/>GTT<br/>InterCloud<br/>Interxion (Digital Realty)<br/>Megaport<br/>Telefonica |

+| **Madrid2** | [Equinix MD2](https://www.equinix.com/data-centers/europe-colocation/spain-colocation/madrid-data-centers/md2) | 1 | &cross; | &check; | Equinix<br/>GÉANT<br/>Intercloud |

+| **Minneapolis** | [Cologix MIN1](https://www.cologix.com/data-centers/minneapolis/min1/) and [Cologix MIN3](https://www.cologix.com/data-centers/minneapolis/min3/) | 1 | &cross; | &check; | Cologix<br/>Megaport<br/>Zayo |

+| **Pune** | [STT GDC Pune DC1](https://www.sttelemediagdc.in/our-data-centres-in-india) | 2 | Central India | &check; | Airtel<br/>Lightstorm<br/>SIFY<br/>Tata Communications |

+| **Santiago** | [EdgeConnex SCL](https://www.edgeconnex.com/locations/south-america/santiago/) | 3 | &cross; | &check; | Cirion Technologies<br/>Equinix<br/>PitChile |

+| **Silicon Valley** | [Equinix SV1](https://www.equinix.com/locations/americas-colocation/united-states-colocation/silicon-valley-data-centers/sv1/) | 1 | West US | &check; | Aryaka Networks<br/>AT&T Dynamic Exchange<br/>AT&T NetBond<br/>British Telecom<br/>CenturyLink Cloud Connect<br/>China Unicom Global<br/>Colt<br/>Comcast<br/>Coresite<br/>Cox Business Cloud Port<br/>Digital Realty<br/>Equinix<br/>InterCloud<br/>Internet2<br/>IX Reach<br/>Level 3 Communications<br/>Megaport<br/>Momentum Telecom<br/>Orange<br/>Packet<br/>Sprint<br/>Tata Communications<br/>Telia Carrier<br/>Verizon<br/>Vodafone<br/>Zayo |

+| **Silicon Valley2** | [Coresite SV7](https://www.coresite.com/data-centers/locations/silicon-valley/sv7) | 1 | West US | &check; | Colt<br/>Coresite<br/>Momentum Telecom |

+| **Singapore** | [Equinix SG1](https://www.equinix.com/data-centers/asia-pacific-colocation/singapore-colocation/singapore-data-center/sg1) | 2 | Southeast Asia | &check; | Aryaka Networks<br/>AT&T NetBond<br/>British Telecom<br/>China Mobile International<br/>China Telecom Global<br/>Epsilon Global Communications<br/>Equinix<br/>GTT<br/>IPC<br/>InterCloud<br/>Level 3 Communications<br/>Megaport<br/>NTT Communications<br/>Orange<br/>PCCW Global Limited<br/>SingTel<br/>Tata Communications<br/>Telstra Corporation<br/>Telefonica<br/>Verizon<br/>Vodafone |

+| **Singapore2** | [Global Switch Tai Seng](https://www.globalswitch.com/locations/singapore-data-centres/) | 2 | Southeast Asia | &check; | CenturyLink Cloud Connect<br/>China Mobile International<br/>China Unicom Global<br/>Colt<br/>DE-CIX<br/>Digital Realty<br/>Epsilon Global Communications<br/>Equinix<br/>Lightstorm<br/>Megaport<br/>PCCW Global Limited<br/>SingTel<br/>Telehouse - KDDI |

+| **Sydney2** | [NextDC S1](https://www.nextdc.com/data-centres/s1-sydney-data-centre) | 2 | Australia East | &check; | AARNet<br/>Megaport<br/>NETSG<br/>NextDC |

+| **Tokyo2** | [AT TOKYO](https://www.attokyo.com/) | 2 | Japan East | &check; | AT TOKYO<br/>China Telecom Global<br/>China Unicom Global<br/>Colt<br/>DE-CIX<br/>Digital Realty<br/>Equinix<br/>IPC<br/>IX Reach<br/>Megaport<br/>PCCW Global Limited<br/>Tokai Communications |

+| **Washington DC** | [Equinix DC2](https://www.equinix.com/locations/americas-colocation/united-states-colocation/washington-dc-data-centers/dc2/)<br/>[Equinix DC6](https://www.equinix.com/data-centers/americas-colocation/united-states-colocation/washington-dc-data-centers/dc6) | 1 | East US<br/>East US 2 | &check; | Aryaka Networks<br/>AT&T NetBond<br/>British Telecom<br/>CenturyLink Cloud Connect<br/>Cologix<br/>Colt<br/>Comcast<br/>Coresite<br/>Cox Business Cloud Port<br/>Crown Castle<br/>Digital Realty<br/>Equinix<br/>IPC<br/>Internet2<br/>InterCloud<br/>IPC<br/>Iron Mountain<br/>IX Reach<br/>Level 3 Communications<br/>Lightpath<br/>Megaport<br/>Momentum Telecom<br/>Neutrona Networks<br/>NTT Communications<br/>Orange<br/>PacketFabric<br/>SES<br/>Sprint<br/>Tata Communications<br/>Telia Carrier<br/>Telefonica<br/>Verizon<br/>Zayo |

+| **[AARNet](https://www.aarnet.edu.au/network-and-services/connectivity-services/azure-expressroute)** |&check; |&check; | Melbourne<br/>Sydney<br/>Sydney2 |

+| **China Mobile International** |&check; |&check; | Hong Kong<br/>Hong Kong2<br/>Singapore<br/>Singapore2 |

+| **China Telecom Global** |&check; |&check; | Hong Kong<br/>Hong Kong2<br/>Singapore<br/>Tokyo2 |

+| **China Unicom Global** |&check; |&check; | Amsterdam<br/>Frankfurt<br/>Hong Kong<br/>Los Angeles<br/>Silicon Valley<br/>Singapore2<br/>Tokyo2 |

+| **DCI Indonesia** |&check; |&check; | Jakarta |

+| **[DE-CIX](https://www.de-cix.net/en/services/directcloud/microsoft-azure)** | &check; |&check; | Amsterdam2<br/>Chennai<br/>Chicago2<br/>Copenhagen<br/>Dallas<br/>Dubai2<br/>Frankfurt<br/>Frankfurt2<br/>Jakarta<br/>Kuala Lumpur<br/>Madrid<br/>Marseille<br/>Mumbai<br/>Munich<br/>New York<br/>Osaka<br/>Oslo<br/>Phoenix<br/>Seattle<br/>Singapore2<br/>Tokyo2 |

+| **[Digital Realty](https://www.digitalrealty.com/partners/microsoft-azure)** | &check; | &check; | Dallas2<br/>Seattle<br/>Silicon Valley<br/>Singapore2<br/>Tokyo2<br/>Washington DC |

+| **[Equinix](https://www.equinix.com/partners/microsoft-azure/)** | &check; | &check; | Amsterdam<br/>Amsterdam2<br/>Atlanta<br/>Berlin<br/>Canberra2<br/>Chicago<br/>Dallas<br/>Dubai2<br/>Dublin<br/>Frankfurt<br/>Frankfurt2<br/>Geneva<br/>Hong Kong<br/>Hong Kong2<br/>London<br/>London2<br/>Los Angeles*<br/>Los Angeles2<br/>Madrid2<br/>Melbourne<br/>Miami<br/>Milan<br/>Mumbai2<br/>New York<br/>Osaka<br/>Paris<br/>Paris2<br/>Perth<br/>Quebec City<br/>Queretaro (Mexico)<br/>Rio de Janeiro<br/>Santiago<br/>Sao Paulo<br/>Seattle<br/>Seoul<br/>Silicon Valley<br/>Singapore<br/>Singapore2<br/>Stockholm<br/>Sydney<br/>Tokyo<br/>Tokyo2<br/>Toronto<br/>Washington DC<br/>Warsaw<br/>Zurich</br>Zurich2</br></br> **New ExpressRoute circuits are no longer supported with Equinix in Los Angeles. Create new circuits in Los Angeles2.* |

+| **[GÉANT](https://www.geant.org/Networks)** | &check; | &check; | Amsterdam<br/>Amsterdam2<br/>Dublin<br/>Frankfurt<br/>Madrid2<br/>Marseille |

+| **GTT** |&check; |&check; | Amsterdam<br/>Dallas<br/>Los Angeles2<br/>London2<br/>Madrid<br/>Singapore<br/>Sydney<br/>Washington DC |

+| **[InterCloud](https://www.intercloud.com/)** |&check; |&check; | Amsterdam<br/>Chicago<br/>Dallas<br/>Dublin2<br/>Frankfurt<br/>Frankfurt2<br/>Geneva<br/>Hong Kong<br/>London<br/>Madrid<br/>Madrid2<br/>Mumbai<br/>New York<br/>Paris<br/>Paris2<br/>Sao Paulo<br/>Silicon Valley<br/>Singapore<br/>Tokyo<br/>Washington DC<br/>Zurich |

+| **IPC** | &check; |&check; | Singapore<br/>Tokyo2<br/>Washington DC |

+| **[Megaport](https://www.megaport.com/services/microsoft-expressroute/)** | &check; | &check; | Amsterdam<br/>Amsterdam2<br/>Atlanta<br/>Auckland<br/>Chicago<br/>Chicago2<br/>Dallas<br/>Denver<br/>Dubai2<br/>Dublin<br/>Dublin2<br/>Frankfurt<br/>Geneva<br/>Hong Kong<br/>Hong Kong2<br/>Las Vegas<br/>London<br/>London2<br/>Los Angeles<br/>Madrid<br/>Melbourne<br/>Miami<br/>Minneapolis<br/>Montreal<br/>Munich<br/>New York<br/>Osaka<br/>Oslo<br/>Paris<br/>Perth<br/>Phoenix<br/>Quebec City<br/>Queretaro (Mexico)<br/>San Antonio<br/>Seattle<br/>Silicon Valley<br/>Singapore<br/>Singapore2<br/>Stavanger<br/>Stockholm<br/>Sydney<br/>Sydney2<br/>Tokyo<br/>Tokyo2<br/>Toronto<br/>Vancouver<br/>Washington DC<br/>Washington DC2<br/>Zurich |

+| **[Momentum Telecom](https://gomomentum.com/)** | &check; | &check; | Atlanta<br/>Chicago<br/>Chicago2<br/>Dallas<br/>Dallas2<br/>Denver<br/>London<br/>Los Angeles<br/>Miami<br/>New York<br/>Silicon Valley<br/>Silicon Valley2<br/>Washington DC<br/>Washington DC2 |

+| **NTT Indonesia** | &check; | &check; | Jakarta |

+| **[SIFY](https://sifytechnologies.com/)** | &check; | &check; | Chennai<br/>Mumbai2<br/>Pune |

+| **[Tata Communications](https://www.tatacommunications.com/solutions/network/cloud-ready-networks/)** | &check; | &check; | Amsterdam<br/>Chennai<br/>Chicago<br/>Hong Kong<br/>London<br/>London2<br/>Mumbai<br/>Pune<br/>Sao Paulo<br/>Silicon Valley<br/>Singapore<br/>Washington DC |

+| **[Zayo](https://www.zayo.com/services/packet/cloudlink/)** | &check; | &check; | Amsterdam<br/>Chicago<br/>Dallas<br/>Denver<br/>Dublin<br/>Frankfurt<br/>Hong Kong<br/>London<br/>London2<br/>Los Angeles<br/>Minneapolis<br/>Montreal<br/>New York<br/>Paris<br/>Phoenix<br/>San Antonio<br/>Seattle<br/>Silicon Valley<br/>Toronto<br/>Toronto2<br/>Vancouver<br/>Washington DC<br/>Washington DC2<br/>Zurich|

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+## Health Deidentification Service

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Azure Machine Learning workspaces should be encrypted with a customer-managed key](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fba769a63-b8cc-4b2d-abf6-ac33c7204be8) |Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at [https://aka.ms/azureml-workspaces-cmk](https://aka.ms/azureml-workspaces-cmk). |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Machine%20Learning/Workspace_CMKEnabled_Audit.json) |

+|[Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fddca0ddc-4e9d-4bbb-92a1-f7c4dd7ef7ce) |Configure Windows SQL Virtual Machines to automatically install the Microsoft Defender for SQL extension. Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). |DeployIfNotExists, Disabled |[1.5.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/MDC_DfSQL_DeployMicrosoftDefenderForSQLWindowsAgent_VM.json) |

+|[Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a Log Analytics workspace](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc859b78a-a128-4376-a838-e97ce6625d16) |Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group, a Data Collection Rule and Log Analytics workspace in the same region as the machine. |DeployIfNotExists, Disabled |[1.7.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/MDC_DfSQL_AMA_DefaultPipeline_VM.json) |

+|[Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F04754ef9-9ae3-4477-bf17-86ef50026304) |Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace. |DeployIfNotExists, Disabled |[1.8.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/MDC_DfSQL_AMA_UserWorkspacePipeline_VM.json) |

+|[Configure the Microsoft Defender for SQL Log Analytics workspace](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F242300d6-1bfc-4d64-8d01-cee583709ebd) |Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and Log Analytics workspace in the same region as the machine. |DeployIfNotExists, Disabled |[1.4.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/MDC_DfSQL_DeployDefaultWorkspace.json) |

+ Title: Create example Standard logic app workflow in Azure portal

+description: Create your first example Standard logic app workflow that runs in single-tenant Azure Logic Apps using the Azure portal.

+This how-to guide shows how to create an example automated workflow that waits for an inbound web request and then sends a message to an email account. More specifically, you create a [Standard logic app resource](logic-apps-overview.md#resource-environment-differences), which can include multiple [stateful and stateless workflows](single-tenant-overview-compare.md#stateful-stateless) that run in single-tenant Azure Logic Apps.

+As you progress, you complete these high-level tasks:

+For more information, see the following documentation:

+- [Single-tenant versus multitenant](single-tenant-overview-compare.md)

+- [Create and deploy to different environments](logic-apps-overview.md#resource-environment-differences)

+* To enable communication from your Standard logic app workflows to a private endpoint on a Premium integration account, you must have an existing Azure virtual network. Both your logic app, virtual network, and integration account must use the same Azure region. Both your logic app and integration account must exist inside the same virtual network. For more information, see [Create a virtual network](../virtual-network/quick-create-portal.md).

+ | Plan type | Description |

+ |--|-|

+ | **Standard** | This logic app type is the default selection. Workflows run in single-tenant Azure Logic Apps and use the [Standard pricing model](logic-apps-pricing.md#standard-pricing). |

+ | **Consumption** | This logic app type and workflow runs in global, multitenant Azure Logic Apps and uses the [Consumption pricing model](logic-apps-pricing.md#consumption-pricing). |

+ | **Storage type** | Yes | - **Azure Storage** <br>- **SQL and Azure Storage** | The storage type that you want to use for workflow-related artifacts and data. <br><br>- To deploy only to Azure, select **Azure Storage**. <br><br>- To use SQL as primary storage and Azure Storage as secondary storage, select **SQL and Azure Storage**, and review [Set up SQL database storage for Standard logic apps in single-tenant Azure Logic Apps](set-up-sql-db-storage-single-tenant-standard-workflows.md). <br><br>**Note**: If you're deploying to an Azure region, you still need an Azure storage account, which is used to complete the one-time hosting of the logic app's configuration on the Azure Logic Apps platform. The workflow's state, run history, and other runtime artifacts are stored in your SQL database. <br><br>For deployments to a custom location that is hosted on an Azure Arc cluster, you only need SQL as your storage provider. |

+1. On the **Networking** tab, you can leave the default options to follow the example. However, for specific, real-world scenarios, make sure to review and select the following appropriate options. You can also change this configuration after you deploy your logic app resource. For more information, see [Secure traffic between Standard logic apps and Azure virtual networks using private endpoints](secure-single-tenant-workflow-virtual-network-private-endpoint.md).

+ The following **Enable public access** setting applies to endpoints on your logic app and doesn't affect whether your logic app can communicate with Azure resources in the same virtual network, for example, a Premium integration account with a private endpoint. To access such Azure resources, your logic app must exist in the same virtual network as these resources.

+ | **On** | Your logic app has a public endpoint with an inbound address that's open to the internet. For clients that are outside an Azure virtual network, they can use this endpoint to access your logic app, but not the virtual network. |

+ | **Off** | Your logic app has no public endpoint, but has a private endpoint instead for communication within an Azure virtual network, and is isolated within that virtual network. The private endpoint can communicate with endpoints in the virtual network, but only from clients within that network. This configuration also means that logic app traffic can be governed by network security groups or affected by virtual network routes. |

+ The following settings control Standard logic app access to endpoints in a virtual network:

+ | **On** | Your logic app workflows can privately and securely communicate with endpoints in the virtual network. <br><br>To enable communication between your logic app and a private endpoint on a Premium integration account, select this option, which also makes the **Virtual Network** section available. For **Virtual Network**, select the Azure virtual network to use. This choice makes the **Inbound access** and **Outbound access** sections available. |

+ The following sections appear after you select a virtual network when **Enable network injection** is set to **On**.

+ **Inbound access**

+ - **Enable private endpoints**: Applies to private endpoints on your Standard logic app and is available only when **Enable public access** is set to **Off**.

+ **Outbound access**

+ - **Enable VNet integration**: To enable communication between a Standard logic app and a private endpoint on a Premium integration account, select **On** and the subnet to use.

+When you create connections in a workflow using [connectors managed by Microsoft](../connectors/managed.md), these connections are separate Azure resources with their own resource definitions and are hosted in global, multitenant Azure. Standard logic app workflows can also use [built-in service provider connectors](/azure/logic-apps/connectors/built-in/reference/) that natively run and are powered by the single-tenant Azure Logic Apps runtime. To view and manage these connections, see [View connections](manage-logic-apps-with-azure-portal.md?tabs=standard#view-connections).

+* Whether you're working on a Consumption or Standard logic app workflow, your logic app resource must already exist if you need to link your integration account.

+ * For Consumption logic app resources, this link is required before you can use the artifacts from your integration account with your workflow. Although you can create your artifacts without this link, the link is required when you're ready to use these artifacts. To create an example Consumption logic app workflow, see [Quickstart: Create an example Consumption logic app workflow in multi-tenant Azure Logic Apps](../quickstart-create-example-consumption-workflow.md).

+ * For Standard logic app resources, this link might be required or optional, based on your scenario:

+ * If you have an integration account with the artifacts that you need or want to use, link the integration account to each Standard logic app resource where you want to use the artifacts.

+ * Some Azure-hosted integration account connectors don't require the link and let you create a connection to your integration account. For example, such as **AS2**, **EDIFACT**, and **X12** don't require the link, but the **AS2 (v2)** connector requires the link.

+ To create an example Standard logic app workflow, see [Create an example Standard logic app workflow in single-tenant Azure Logic Apps](../create-single-tenant-workflows-azure-portal.md).

+* A [Premium integration account](#create-integration-account) supports using a [private endpoint](../../private-link/private-endpoint-overview.md) within an Azure virtual network to securely communicate with other Azure resources in the same network. Your integration account, virtual network, and Azure resources must also exist in the same Azure region. For more information, see [Create a virtual network](../../virtual-network/quick-create-portal.md) and the steps in this guide to set up your Premium integration account.

+ For example, a Standard logic app can access the private endpoint if they exist in the same virtual network. However, a Consumption logic app doesn't support virtual network integration and can't access the private endpoint.

+ - To create a Standard logic app with virtual network integration, see [Create an example Standard logic app workflow in single-tenant Azure Logic Apps](../create-single-tenant-workflows-azure-portal.md).

+

+ - To set up an existing Standard logic app with virtual network integration, see [Set up virtual network integration](../secure-single-tenant-workflow-virtual-network-private-endpoint.md#set-up-virtual-network-integration).

+<a name="create-integration-account"></a>

+| **Premium** (preview) | **Note:** This capability is in preview and is subject to the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). <br><br>For scenarios with the following criteria: <br><br>- Store and use unlimited artifacts, such as partners, agreements, schemas, maps, certificates, and so on. <br><br>- Bring and use your own storage, which contains the relevant runtime states for specific B2B actions and EDI standards. For example, these states include the MIC number for AS2 actions and the control numbers for X12 actions, if configured on your agreements. <br><br>To access this storage, your integration account uses its system-assigned managed identity, which is automatically created and enabled for your integration account. <br><br>You can also apply more governance and policies to data, such as customer-managed ("Bring Your Own") keys for data encryption. To store these keys, you'll need a key vault. <br><br>- Set up and use a key vault to store private certificates or customer-managed keys. To access these keys, your Premium integration account uses its system-assigned managed identity, not an Azure Logic Apps shared service principal. <br><br>- Set up a private endpoint that creates a secure connection between your Premium integration account and Azure services in an Azure virtual network. <br><br>Pricing follows [Standard integration account pricing](https://azure.microsoft.com/pricing/details/logic-apps/). <br><br>**Note**: During preview, your Azure bill uses the same meter name and ID as a Standard integration account, but changes when the Premium level becomes generally available. <br><br>**Limitations and known issues**: <br><br>- If you use a key vault to store private certificates, your integration account's managed identity might not work. For now, use the linked logic app's managed identity instead. <br><br>- Currently doesn't support the [Azure CLI for Azure Logic Apps](/cli/azure/service-page/logic%20apps). |

+1. If you created a Premium integration account, make sure to [set up access to the associated Azure storage account](#set-up-access-storage-account). You can also create a private connection between your Premium integration account and Azure services by [setting up a private endpoint for your integration account](#set-up-private-endpoint).

+<a name="set-up-private-endpoint"></a>

+## Set up private endpoint for Premium integration account (Preview)

+> [!NOTE]

+>

+> This capability is in preview and is subject to the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).

+To create a secure connection between your Premium integration account and Azure services, you can set up a [private endpoint](../../private-link/private-endpoint-overview.md) for your integration account. This endpoint is a network interface that uses a private IP address from your Azure virtual network. This way, traffic between your virtual network and Azure services stays on the Azure backbone network and never traverses the public internet. Private endpoints ensure a secure, private communication channel between your resources and Azure services by providing the following benefits:

+- Eliminates exposure to the public internet and reducing the risks from attacks.

+- Helps your organization meet data privacy and compliance requirements by keeping data within a controlled and secured environment.

+- Reduces latency and improve workflow performance by keeping traffic within the Azure backbone network.

+- Removes the need for complex network setups, such as virtual private networks or ExpressRoute.

+- Saves on costs by reducing extra network infrastructure and avoiding data egress charges through public endpoints.

+### Best practices for private endpoints

+- Carefully plan your virtual network and subnet architecture to accommodate private endpoints. Make sure to properly segment and secure your subnets.

+- Make sure that your domain name system settings are up-to-date and correctly configured to handle name resolution for private endpoints.

+- Control traffic flow to and from your private endpoints and enforce strict security policies by using network security groups.

+- Thoroughly test your integration account's connectivity and performance to make sure that everything works as expected with private endpoints before you deploy to production.

+- Regularly monitor network traffic to and from your private endpoints. Audit and analyze traffic patterns by using tools such as Azure Monitor and Azure Security Center.

+### Create a private endpoint

+Before you start, make sure that you have an [Azure virtual network](../../virtual-network/quick-create-portal.md) defined with the appropriate subnets and network security groups to manage and secure traffic.

+1. In the [Azure portal](https://portal.azure.com), in the search box, enter **private endpoint**,and then select **Private endpoints**.

+1. On the **Private endpoints** page, select **Create**.

+1. On the **Basics** tab, provide the following information:

+ | Property | Value |

+ |-|-|

+ | **Subscription** | <*Azure-subscription*> |

+ | **Resource group** | <*Azure-resource-group*> |

+ | **Name** | <*private-endpoint*> |

+ | **Network interface name** | <*private-endpoint*>**-nic** |

+ | **Region** | <*Azure-region*> |

+1. On the **Resource** tab, provide the following information:

+ | Property | Value |

+ |-|-|

+ | **Connection method** | - **Connect to an Azure resource in my directory**: Creates a private endpoint that is *automatically approved* and ready for immediate use. The endpoint's **Connection status** property is set to **Approved** after creation. <br><br>- **Connect to an Azure resource by resource ID or alias**: Create a private endpoint that is *manually approved* and requires data administrator approval before anyone can use. The endpoint's **Connection status** property is set to **Pending** after creation. <br><br>**Note**: If the endpoint is manually approved, the **DNS** tab is unavailable. |

+ | **Subscription** | <*Azure-subscription*> |

+ | **Resource type** | **Microsoft.Logic/integrationAccounts** |

+ | **Resource** | <*Premium-integration-account*> |

+ | **Target sub-resource** | **integrationAccount** |

+1. On the **Virtual Network** tab, specify the virual network and subnet where to you want to create the endpoint:

+ | Property | Value |

+ |-|-|

+ | **Virtual network** | <*virtual-network*> |

+ | **Subnet** | <*subnet-for-endpoint*> |

+ Your virtual network uses a network interface attached to the private endpoint.

+1. On the **DNS** tab, provide the following information to make sure your aps can resolve the private IP address for your integration account. You might have to set up a private DNS zone and link to your virtual network.

+ | Property | Value |

+ |-|-|

+ | **Subscription** | <*Azure-subscription*> |

+ | **Resource group** | <*Azure-resource-group-for-private-DNS-zone*> |

+1. When you're done, confirm all the provided information, and select **Create**.

+1. After you confirm that Azure created the private endpoint, check your connectivity and test your setup to make sure that the resources in your virtual network can securely connect to the your integration account through the private endpoint.

+### View pending endpoint connections

+For a private endpoint that requires approval, follow these steps:

+1. In the Azure portal, go to the **Private Link** page.

+1. On the left menu, select **Pending connections**.

+### Approve a pending private endpoint

+For a private endpoint that requires approval, follow these steps:

+1. In the Azure portal, go to the **Private Link** page.

+1. On the left menu, select **Pending connections**.

+1. Select the pending connection. On the toolbar, select **Approve**. Wait for the operation to finish.

+ The endpoint's **Connection status** property changes to **Approved**.

+<a name="call-integration-account-api"></a>

+### Enable Standard logic app calls through private endpoint on Premium integration account

+1. Choose one of the following options:

+ - To create a Standard logic app with virtual network integration, see [Create an example Standard logic app workflow in single-tenant Azure Logic Apps](../create-single-tenant-workflows-azure-portal.md).

+

+ - To set up an existing Standard logic app with virtual network integration, see [Set up virtual network integration](../secure-single-tenant-workflow-virtual-network-private-endpoint.md#set-up-virtual-network-integration).

+1. To make calls through the private endpoint, include an **HTTP** action in your Standard logic app workflow where you want to call the integration account.

+1. In the Azure portal, go to your Premium integration account. On the integration account menu, under **Settings**, select **Callback URL**, and copy the URL.

+1. In your workflow's **HTTP** action, on the **Parameters** tab, in the **URI** property, enter the callback URL using the following format:

+ **`https://{domain-name}-{integration-account-ID}.cy.integrationaccounts.microsoftazurelogicapps.net:443/integrationAccounts/{integration-account-ID}?api-version=2015-08-01-preview&sp={sp}&sv={sv}&sig={sig}`**

+ The following example shows sample values:

+ `https://prod-02-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.cy.integrationaccounts.microsoftazurelogicapps.net:443/integrationAccounts/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX?api-version=2015-08-01-preview&sp={sp}&sv={sv}&sig={sig}`

+1. For the **HTTP** action's **Method** property, select **GET**.

+1. Finish setting up the **HTTP** action as necessary, and test your workflow.

+| Spain Central | 68.221.3.54, 68.221.3.29, 68.221.249.214, 68.221.249.187, 68.221.249.249, 68.221.249.208, 68.221.249.227, 68.221.250.1, 68.221.249.191 |

+| Spain Central | 68.221.3.7, 68.221.1.175, 68.221.2.156, 68.221.2.37, 68.221.249.177, 68.221.249.251, 68.221.249.213, 68.221.249.186, 68.221.249.215, 68.221.249.210, 68.221.249.185, 68.221.249.203, 68.221.249.175, 68.221.249.229, 68.221.249.205, 68.221.249.184, 68.221.249.202, 68.221.249.209, 68.221.249.252, 68.221.250.2 |

+<a name="set-up-virtual-network-integration"></a>

+* [Configure Grafana teams](how-to-sync-teams-with-entra-groups.md)

+* [Microsoft Entra groups](how-to-sync-teams-with-entra-groups.md) is available in preview in Azure Managed Grafana.

+ Title: Configure Grafana Team Sync with Microsoft Entra groups

+description: Learn how to configure Grafana Teams and allow access to Grafana folders and dashboards using Microsoft Entra groups in Azure Managed Grafana.

+#customer intent: As a Grafana administrator, I want to use Microsoft Entra groups to set up Grafana teams and control access to specific folders and dashboards.

+

+# Configure Grafana teams with Microsoft Entra groups and Grafana Team Sync

+In this guide, you learn how to use Microsoft Entra groups with [Grafana Team Sync](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-team-sync/) to manage dashboard permissions in Azure Managed Grafana.

+In Azure Managed Grafana, you can use Azure's role-based access control (RBAC) roles for Grafana to define access rights. These permissions apply to all resources in your Grafana workspace by default, not per folder or dashboard. If you assign a user to the Grafana Editor role, that user can edit any dashboard in your Grafana workspace. However, with Grafana's [granular permission model](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-team-sync/), you can adjust a user's default permission level for specific dashboards or dashboard folders.

+Microsoft Entra group sync helps you manage this. With it, you can create a *Grafana team* in a Grafana workspace, link it to a Microsoft Entra group, and then configure your dashboard permissions for that team. For example, you can allow a Grafana viewer to modify a dashboard, or prevent a Grafana editor from making changes.

+<a name='set-up-azure-ad-group-sync'></a>

+## Prerequisites

+Before you start, make sure you have:

+- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free).

+- An Azure Managed Grafana instance. If needed, [create a new instance](quickstart-managed-grafana-portal.md).

+- A Microsoft Entra group. If needed, [create a basic group and add members](/entra/fundamentals/how-to-manage-groups#create-a-basic-group-and-add-members).

+- The Grafana Admin role is required to use Grafana Team Sync.

+## Assign a permission to a Microsoft Entra group

+The Microsoft Entra group must have a Grafana role to access the Grafana instance.

+1. In your Grafana workspace, open the **Access control (IAM)** menu select **Add** > **Add new role assignment**.

+ :::image type="content" source="media/azure-ad-group-sync/add-role-assignment.png" alt-text="Screenshot of the Azure portal. Adding a new role assignment.":::

+1. Assign a role, such as **Grafana viewer**, to the Microsoft Entra group. For more information about assigning a role, go to [Grant access](../role-based-access-control/quickstart-assign-role-user-portal.md#grant-access).

+### Create a Grafana team

+Set up a Microsoft Entra ID-backed Grafana team.

+1. In the Azure portal, open your Grafana instance and select **Configuration** under **Settings**.

+1. Select the **Microsoft Entra Team Sync Settings** tab.

+1. Select **Create new Grafana team**.

+ :::image type="content" source="media/azure-ad-group-sync/team-sync-settings.png" alt-text="Screenshot of the Azure portal. Configuring Microsoft Entra Team Sync.":::

+1. Enter a name for the Grafana team and select **Add**.

+ :::image type="content" source="media/azure-ad-group-sync/create-new-grafana-team.png" alt-text="Screenshot of the Azure portal. Creating a new Grafana team.":::

+### Assign a Microsoft Entra group to a Grafana team

+1. In **Assign access to**, select the newly created Grafana team.

+1. Select **+ Add a Microsoft Entra group**.

+1. In the search box, enter a Microsoft Entra group name and select the group name in the results. Click **Select** to confirm.

+ :::image type="content" source="media/azure-ad-group-sync/select-azure-ad-group.png" alt-text="Screenshot of the Azure portal. Finding and selecting a Microsoft Entra group.":::

+1. Optionally repeat the previous three steps to add more Microsoft Entra groups to the Grafana team.

+### Assign access to a Grafana folder or dashboard

+1. In the Grafana UI, open a folder or a dashboard.

+1. In the **Permissions** tab, select **Add a permission**.

+ :::image type="content" source="media/azure-ad-group-sync/add-permission.png" alt-text="Screenshot of the Azure portal, selecting Add a permission." lightbox="media/azure-ad-group-sync/add-permission.png":::

+1. Under **Add permission for**, select **Team**, then select the team name, the **View**, **Edit** or **Admin** permission, and save. You can add permissions for a user, a team or a role.

+ :::image type="content" source="media/azure-ad-group-sync/add-permission-for-team.png" alt-text="Screenshot of the Grafana UI, adding a permission for a team in a Grafana folder.":::

+ > [!TIP]

+ > To check existing access permissions for a dashboard, open a dashboard and go to the **Permissions** tab. This page shows all permissions assigned for this dashboard and all inherited permissions.

+ > :::image type="content" source="media/azure-ad-group-sync/view-permissions.png" alt-text="Screenshot of the Grafana UI, showing permission for a Grafana dashboard.":::

+### Scope down access

+You can limit access by removing permissions to access one or more folders.

+For example, to disable access to a user who has the Grafana Viewer role on a Grafana instance, remove their access to a Grafana folder by following these steps:

+1. In the Grafana UI, go to a folder you want to hide from the user.

+1. In the **Permissions** tab, select the **X** button to the right of the **Viewer** permission to remove this permission from this folder.

+1. Repeat this step for all folders you want to hide from the user.

+ :::image type="content" source="media/azure-ad-group-sync/remove-permission.png" alt-text="Screenshot of the Grafana UI, removing the Viewer permission in a Grafana folder.":::

+<a name='remove-azure-ad-group-sync'></a>

+## Remove a Grafana team

+If you no longer need a Grafana team, follow these steps to delete it. Deleting a Grafana team also removes the link to the Microsoft Entra group.

+1. In the Azure portal, open your Azure Managed Grafana workspace.

+1. Select **Administration > Teams**.

+1. Select the **X** button to the right of a team you're deleting.

+ :::image type="content" source="media/azure-ad-group-sync/remove-azure-ad-group-sync.png" alt-text="Screenshot of the Grafana platform. Removing a Grafana team.":::

+1. Select **Delete** to confirm.

+## Next steps

+In this how-to guide, you learned how to set up Grafana teams backed by Microsoft Entra groups. To learn how to use teams to control access to dashboards in your workspace, see [Manage dashboard permissions](https://grafana.com/docs/grafana/latest/administration/user-management/manage-dashboard-permissions/).

+SHA256 | [!INCLUDE [hyper-v-vhd.md](includes/hyper-v-vhd.md)]

+ Hyper-V (85.8 MB) | [Latest version](https://go.microsoft.com/fwlink/?linkid=2191847) | [!INCLUDE [security-hash-value.md](includes/security-hash-value.md)]

+ Title: "Azure Operator Nexus: Runtime upgrade with PauseRack strategy"

+description: Learn to execute a cluster runtime upgrade for Operator Nexus with a PauseRack strategy

+#

+# Upgrading cluster runtime with a PauseRack strategy

+This how-to guide explains the steps to execute a cluster runtime upgrade with PauseRack strategy. Executing cluster runtime upgrade with PauseRack strategy will update a single rack in a cluster and then pause to wait for confirmation before moving to the next rack. All existing thresholds will still be honored.

+## Prerequisites

+> [!NOTE]

+> Upgrades with the PauseRack strategy is available starting API version 2024-06-01-preview.

+1. The [Install Azure CLI][installation-instruction] must be installed.

+2. The `networkcloud` CLI extension is required. If the `networkcloud` extension isn't installed, it can be installed following the steps listed [here](https://github.com/MicrosoftDocs/azure-docs-pr/blob/main/articles/operator-nexus/howto-install-cli-extensions.md).

+3. Access to the Azure portal for the target cluster to be upgraded.

+4. You must be logged in to the same subscription as your target cluster via `az login`

+5. Target cluster must be in a running state, with all control plane nodes healthy and 80+% of compute nodes in a running and healthy state.

+## Procedure

+1. Enable PauseRack upgrade strategy on a Nexus cluster

+ ```azurecli

+ az networkcloud cluster update

+ --name $CLUSTER_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --update-strategy strategy-type="PauseRack" wait-time-minutes=0

+ ```

+2. Confirm that the cluster resource JSON in the JSON View reflects the PauseRack upgrade strategy.

+ ```azurecli

+ az networkcloud cluster show --cluster-name "clusterName" --resource-group "resourceGroupName"

+ ```

+ ```

+ "updateStrategy": {

+ "maxUnavailable": 2,

+ "strategyType": "PauseAfterRack",

+ "thresholdType": "PercentSuccess",

+ "thresholdValue": 70,

+ "waitTimeMinutes": 15,

+ }

+ ```

+3. Trigger runtime bundle upgrade as usual from Azure portal / CLI. For reference [Upgrading cluster runtime from Azure CLI](./howto-cluster-runtime-upgrade.md)

+4. Once Rack 1 completes, the runtime upgrade will be paused, awaiting user action to resume the upgrade for Rack 2.

+> [!NOTE]

+> This message will be available in logs for programtic access, for more details follow [List of logs available for streaming in Azure Operator Nexus](list-logs-available.md)

+5. To resume the runtime upgrade, execute the following `az networkcloud` cli command.

+```shell

+az networkcloud cluster continue-update-version \

+ --subscription=$SUBSCRIPTION \

+ --resource-group=$RESOURCE_GROUP \

+ --cluster-name=$CLUSTER_NAME

+```

+6. Repeat step 5 for each rack until all racks have been upgraded to the latest runtime bundle.

+## Related content

+- [Upgrading cluster runtime from Azure CLI](./howto-cluster-runtime-upgrade.md)

+az networkcloud cluster update /

+--name "<clusterName>" /

+--resource-group "<resourceGroup>" /

+--update-strategy strategy-type="Rack" threshold-type="PercentSuccess" /

+threshold-value="<thresholdValue>" max-unavailable=<maxNodesOffline> /

+wait-time-minutes=<waitTimeBetweenRacks>

+Required parameters:

+- strategy-type: Defines the update strategy. In this case, "Rack" means updates occur rack-by-rack. The default value is "Rack".

+Optional parameters:

+```

+ "updateStrategy": {

+ }

+> [!NOTE]

+> When a threshold value below 100% is set, itΓÇÖs possible that any unhealthy nodes might not be upgraded, yet the ΓÇ£ClusterΓÇ¥ status could still indicate that upgrade was successful. For troubleshooting issues with bare metal machines, please refer to [Troubleshoot Azure Operator Nexus server problems](troubleshoot-reboot-reimage-replace.md)

+## Upgrade with PauseRack strategy

+Starting with API version 2024-06-01-preview, runtime upgrades can be triggered using a "PauseRack" strategy. When you execute a Cluster runtime upgrade with the PauseRack" strategy, it will update one rack at a time in the Cluster and then stop, awaiting confirmation before proceeding to the next rack. All existing thresholds will continue to be respected with the "PauseRack" strategy. To carry out a Cluster runtime upgrade using the "PauseRack" strategy follow the steps outlined in [Upgrading cluster runtime with a pause rack strategy](howto-cluster-runtime-upgrade-with-pauserack-strategy.md)

+During a runtime upgrade, impacted Nexus Kubernetes Cluster nodes are cordoned and drained before the Bare Metal Hosts (BMH) are upgraded. Cordoning the Kubernetes Cluster node prevents new pods from being scheduled on it and draining the Kubernetes Cluster node allows pods that are running tenant workloads a chance to shift to another available Kubernetes Cluster node, which helps to reduce the impact on services. The draining mechanism's effectiveness is contingent on the available capacity within the Nexus Kubernetes Cluster. If the Kubernetes Cluster is nearing full capacity and lacks space for the pods to relocate, they transition into a Pending state following the draining process.

+It is important to note that following the runtime upgrade, there could be instance where a Nexus Kubernetes Cluster node remains cordoned. For such scenario, you can manually uncordon the node by executing the following command

+```azurecli

+az networkcloud baremetalmachine list -g $mrg --subscription $sub --query "sort_by([].{name:name,kubernetesNodeName:kubernetesNodeName,location:location,readyState:readyState,provisioningState:provisioningState,detailedStatus:detailedStatus,detailedStatusMessage:detailedStatusMessage,powerState:powerState,tags:tags.Status,machineRoles:join(', ', machineRoles),cordonStatus:cordonStatus,createdAt:systemData.createdAt}, &name)"

+--output table

+```

+| Azure AI Search | Microsoft.Search/searchServices | searchService |

+| Azure Cosmos DB for PostgreSQL | Microsoft.DBforPostgreSQL/serverGroupsv2 | coordinator |

+| Azure Database for MySQL - Flexible Server | Microsoft.DBforMySQL/flexibleServers | mysqlServer |

+| Azure Database for PostgreSQL - Single server | Microsoft.DBforPostgreSQL/servers | postgresqlServer |

+| Integration Account (Premium) | Microsoft.Logic/integrationAccounts | integrationAccount |

+ Title: Migrate Log Analytics Dedicated Cluster workspaces to availability zone support

+description: Learn how to migrate Log Analytics Dedicated Cluster workspaces to availability zone support.

+# Migrate Log Analytics Dedicated Cluster workspaces to availability zone support

+This guide describes how to migrate dedicated cluster Log Analytics Dedicated Cluster workspaces from non-availability zone support to availability support.

+- This article applies to workspaces that use dedicated clusters. If your workspace isnΓÇÖt using a dedicated cluster, itΓÇÖs using a shared cluster, which is managed by the Log Analytics service. In regions that have availability zones, shared clusters use availability zones or are being migrated to use them. For more details, see [Log Analytics - Supported regions](/azure/azure-monitor/logs/availability-zones#supported-regions).

+- Make sure that the region to which you wish to move is a region that supports availability zones. To see which regions support availability zones, see [supported regions](/azure/azure-monitor/logs/availability-zones#supported-regions).

+> | <a name='azure-arc-vmware-vm-contributor'></a>[Azure Arc VMware VM Contributor](./built-in-roles/compute.md#azure-arc-vmware-vm-contributor) | Arc VMware VM Contributor has permissions to perform all VM actions. | b748a06d-6150-4f8a-aaa9-ce3940cd96cb |

+> | <a name='desktop-virtualization-power-on-contributor'></a>[Desktop Virtualization Power On Contributor](./built-in-roles/compute.md#desktop-virtualization-power-on-contributor) | Provide permission to the Azure Virtual Desktop Resource Provider to start virtual machines. | 489581de-a3bd-480d-9518-53dea7416b33 |

+> | <a name='desktop-virtualization-power-on-off-contributor'></a>[Desktop Virtualization Power On Off Contributor](./built-in-roles/compute.md#desktop-virtualization-power-on-off-contributor) | Provide permission to the Azure Virtual Desktop Resource Provider to start and stop virtual machines. | 40c5ff49-9181-41f8-ae61-143b0e78555e |

+> | <a name='desktop-virtualization-virtual-machine-contributor'></a>[Desktop Virtualization Virtual Machine Contributor](./built-in-roles/compute.md#desktop-virtualization-virtual-machine-contributor) | This role is in preview and subject to change. Provide permission to the Azure Virtual Desktop Resource Provider to create, delete, update, start, and stop virtual machines. | a959dbd1-f747-45e3-8ba6-dd80f235f97c |

+> | <a name='windows-365-network-interface-contributor'></a>[Windows 365 Network Interface Contributor](./built-in-roles/compute.md#windows-365-network-interface-contributor) | This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces. | 1f135831-5bbe-4924-9016-264044c00788 |

+> | <a name='windows-365-network-user'></a>[Windows 365 Network User](./built-in-roles/compute.md#windows-365-network-user) | This role is used by Windows 365 to read virtual networks and join the designated virtual networks. | 7eabc9a4-85f7-4f71-b8ab-75daaccc1033 |

+> | <a name='backup-mua-admin'></a>[Backup MUA Admin](./built-in-roles/storage.md#backup-mua-admin) | Backup MultiUser-Authorization. Can create/delete ResourceGuard | c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8 |

+> | <a name='backup-mua-operator'></a>[Backup MUA Operator](./built-in-roles/storage.md#backup-mua-operator) | Backup MultiUser-Authorization. Allows user to perform critical operation protected by resourceguard | f54b6d04-23c6-443e-b462-9c16ab7b4a52 |

+> | <a name='elastic-san-network-admin'></a>[Elastic SAN Network Admin](./built-in-roles/storage.md#elastic-san-network-admin) | Allows access to create Private Endpoints on SAN resources, and to read SAN resources | fa6cecf6-5db3-4c43-8470-c540bcb4eafa |

+> | <a name='azure-maps-search-and-render-data-reader'></a>[Azure Maps Search and Render Data Reader](./built-in-roles/web-and-mobile.md#azure-maps-search-and-render-data-reader) | Grants access to very limited set of data APIs for common visual web SDK scenarios. Specifically, render and search data APIs. | 6be48352-4f82-47c9-ad5e-0acacefdb005 |

+> | <a name='azure-spring-apps-application-configuration-service-config-file-pattern-reader-role'></a>[Azure Spring Apps Application Configuration Service Config File Pattern Reader Role](./built-in-roles/web-and-mobile.md#azure-spring-apps-application-configuration-service-config-file-pattern-reader-role) | Read content of config file pattern for Application Configuration Service in Azure Spring Apps | 25211fc6-dc78-40b6-b205-e4ac934fd9fd |

+> | <a name='azure-spring-apps-application-configuration-service-log-reader-role'></a>[Azure Spring Apps Application Configuration Service Log Reader Role](./built-in-roles/web-and-mobile.md#azure-spring-apps-application-configuration-service-log-reader-role) | Read real-time logs for Application Configuration Service in Azure Spring Apps | 6593e776-2a30-40f9-8a32-4fe28b77655d |

+> | <a name='azure-spring-apps-connect-role'></a>[Azure Spring Apps Connect Role](./built-in-roles/web-and-mobile.md#azure-spring-apps-connect-role) | Azure Spring Apps Connect Role | 80558df3-64f9-4c0f-b32d-e5094b036b0b |

+> | <a name='azure-spring-apps-job-log-reader-role'></a>[Azure Spring Apps Job Log Reader Role](./built-in-roles/web-and-mobile.md#azure-spring-apps-job-log-reader-role) | Read real-time logs for jobs in Azure Spring Apps | b459aa1d-e3c8-436f-ae21-c0531140f43e |

+> | <a name='azure-spring-apps-remote-debugging-role'></a>[Azure Spring Apps Remote Debugging Role](./built-in-roles/web-and-mobile.md#azure-spring-apps-remote-debugging-role) | Azure Spring Apps Remote Debugging Role | a99b0159-1064-4c22-a57b-c9b3caa1c054 |

+> | <a name='azure-spring-apps-spring-cloud-gateway-log-reader-role'></a>[Azure Spring Apps Spring Cloud Gateway Log Reader Role](./built-in-roles/web-and-mobile.md#azure-spring-apps-spring-cloud-gateway-log-reader-role) | Read real-time logs for Spring Cloud Gateway in Azure Spring Apps | 4301dc2a-25a9-44b0-ae63-3636cf7f2bd2 |

+> | <a name='web-pubsub-service-owner'></a>[Web PubSub Service Owner](./built-in-roles/web-and-mobile.md#web-pubsub-service-owner) | Full access to Azure Web PubSub Service REST APIs | 12cf5a90-567b-43ae-8102-96cf46c7d9b4 |

+> | <a name='web-pubsub-service-reader'></a>[Web PubSub Service Reader](./built-in-roles/web-and-mobile.md#web-pubsub-service-reader) | Read-only access to Azure Web PubSub Service REST APIs | bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf |

+> | <a name='connected-cluster-managed-identity-checkaccess-reader'></a>[Connected Cluster Managed Identity CheckAccess Reader](./built-in-roles/containers.md#connected-cluster-managed-identity-checkaccess-reader) | Built-in role that allows a Connected Cluster managed identity to call the checkAccess API | 65a14201-8f6c-4c28-bec4-12619c5a9aaa |

+> | <a name='postgresql-flexible-server-long-term-retention-backup-role'></a>[PostgreSQL Flexible Server Long Term Retention Backup Role](./built-in-roles/databases.md#postgresql-flexible-server-long-term-retention-backup-role) | Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup. | c088a766-074b-43ba-90d4-1fb21feae531 |

+> | <a name='hdinsight-on-aks-cluster-admin'></a>[HDInsight on AKS Cluster Admin](./built-in-roles/analytics.md#hdinsight-on-aks-cluster-admin) | Grants a user/group the ability to create, delete and manage clusters within a given cluster pool. Cluster Admin can also run workloads, monitor, and manage all user activity on these clusters. | fd036e6b-1266-47a0-b0bb-a05d04831731 |

+> | <a name='hdinsight-on-aks-cluster-pool-admin'></a>[HDInsight on AKS Cluster Pool Admin](./built-in-roles/analytics.md#hdinsight-on-aks-cluster-pool-admin) | Can read, create, modify and delete HDInsight on AKS cluster pools and create clusters | 7656b436-37d4-490a-a4ab-d39f838f0042 |

+> | <a name='agfood-platform-sensor-partner-contributor'></a>[AgFood Platform Sensor Partner Contributor](./built-in-roles/ai-machine-learning.md#agfood-platform-sensor-partner-contributor) | Provides contribute access to manage sensor related entities in AgFood Platform Service | 6b77f0a0-0d89-41cc-acd1-579c22c17a67 |

+> | <a name='agfood-platform-service-admin'></a>[AgFood Platform Service Admin](./built-in-roles/ai-machine-learning.md#agfood-platform-service-admin) | Provides admin access to AgFood Platform Service | f8da80de-1ff9-4747-ad80-a19b7f6079e3 |

+> | <a name='agfood-platform-service-contributor'></a>[AgFood Platform Service Contributor](./built-in-roles/ai-machine-learning.md#agfood-platform-service-contributor) | Provides contribute access to AgFood Platform Service | 8508508a-4469-4e45-963b-2518ee0bb728 |

+> | <a name='agfood-platform-service-reader'></a>[AgFood Platform Service Reader](./built-in-roles/ai-machine-learning.md#agfood-platform-service-reader) | Provides read access to AgFood Platform Service | 7ec7ccdc-f61e-41fe-9aaf-980df0a44eba |

+> | <a name='azureml-metrics-writer-preview'></a>[AzureML Metrics Writer (preview)](./built-in-roles/ai-machine-learning.md#azureml-metrics-writer-preview) | Lets you write metrics to AzureML workspace | 635dd51f-9968-44d3-b7fb-6d9a6bd613ae |

+> | <a name='azureml-registry-user'></a>[AzureML Registry User](./built-in-roles/ai-machine-learning.md#azureml-registry-user) | Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources. | 1823dd4f-9b8c-4ab6-ab4e-7397a3684615 |

+> | <a name='cognitive-services-immersive-reader-user'></a>[Cognitive Services Immersive Reader User](./built-in-roles/ai-machine-learning.md#cognitive-services-immersive-reader-user) | Provides access to create Immersive Reader sessions and call APIs | b2de6794-95db-4659-8781-7e080d3f2b9d |

+> | <a name='cognitive-services-language-owner'></a>[Cognitive Services Language Owner](./built-in-roles/ai-machine-learning.md#cognitive-services-language-owner) | Has access to all Read, Test, Write, Deploy and Delete functions under Language portal | f07febfe-79bc-46b1-8b37-790e26e6e498 |

+> | <a name='cognitive-services-language-reader'></a>[Cognitive Services Language Reader](./built-in-roles/ai-machine-learning.md#cognitive-services-language-reader) | Has access to Read and Test functions under Language portal | 7628b7b8-a8b2-4cdc-b46f-e9b35248918e |

+> | <a name='cognitive-services-language-writer'></a>[Cognitive Services Language Writer](./built-in-roles/ai-machine-learning.md#cognitive-services-language-writer) | Has access to all Read, Test, and Write functions under Language Portal | f2310ca1-dc64-4889-bb49-c8e0fa3d47a8 |

+> | <a name='cognitive-services-luis-owner'></a>[Cognitive Services LUIS Owner](./built-in-roles/ai-machine-learning.md#cognitive-services-luis-owner) | Has access to all Read, Test, Write, Deploy and Delete functions under LUIS | f72c8140-2111-481c-87ff-72b910f6e3f8 |

+> | <a name='cognitive-services-luis-reader'></a>[Cognitive Services LUIS Reader](./built-in-roles/ai-machine-learning.md#cognitive-services-luis-reader) | Has access to Read and Test functions under LUIS. | 18e81cdc-4e98-4e29-a639-e7d10c5a6226 |

+> | <a name='cognitive-services-luis-writer'></a>[Cognitive Services LUIS Writer](./built-in-roles/ai-machine-learning.md#cognitive-services-luis-writer) | Has access to all Read, Test, and Write functions under LUIS | 6322a993-d5c9-4bed-b113-e49bbea25b27 |

+> | <a name='cognitive-services-metrics-advisor-user'></a>[Cognitive Services Metrics Advisor User](./built-in-roles/ai-machine-learning.md#cognitive-services-metrics-advisor-user) | Access to the project. | 3b20f47b-3825-43cb-8114-4bd2201156a8 |

+> | <a name='cognitive-services-speech-contributor'></a>[Cognitive Services Speech Contributor](./built-in-roles/ai-machine-learning.md#cognitive-services-speech-contributor) | Full access to Speech projects, including read, write and delete all entities, for real-time speech recognition and batch transcription tasks, real-time speech synthesis and long audio tasks, custom speech and custom voice. | 0e75ca1e-0464-4b4d-8b93-68208a576181 |

+> | <a name='cognitive-services-speech-user'></a>[Cognitive Services Speech User](./built-in-roles/ai-machine-learning.md#cognitive-services-speech-user) | Access to the real-time speech recognition and batch transcription APIs, real-time speech synthesis and long audio APIs, as well as to read the data/test/model/endpoint for custom models, but can't create, delete or modify the data/test/model/endpoint for custom models. | f2dc8367-1007-4938-bd23-fe263f013447 |

+> | <a name='health-bot-admin'></a>[Health Bot Admin](./built-in-roles/ai-machine-learning.md#health-bot-admin) | Users with admin access can sign in, view and edit all of the bot resources, scenarios and configuration setting including the bot instance keys & secrets. | f1082fec-a70f-419f-9230-885d2550fb38 |

+> | <a name='health-bot-editor'></a>[Health Bot Editor](./built-in-roles/ai-machine-learning.md#health-bot-editor) | Users with editor access can sign in, view and edit all the bot resources, scenarios and configuration setting except for the bot instance keys & secrets and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). A read-only access to the bot skills and channels. | af854a69-80ce-4ff7-8447-f1118a2e0ca8 |

+> | <a name='health-bot-reader'></a>[Health Bot Reader](./built-in-roles/ai-machine-learning.md#health-bot-reader) | Users with reader access can sign in, have read-only access to the bot resources, scenarios and configuration setting except for the bot instance keys & secrets (including Authentication, Data Connection and Channels keys) and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). | eb5a76d5-50e7-4c33-a449-070e7c9c4cf2 |

+> | <a name='device-provisioning-service-data-contributor'></a>[Device Provisioning Service Data Contributor](./built-in-roles/internet-of-things.md#device-provisioning-service-data-contributor) | Allows for full access to Device Provisioning Service data-plane operations. | dfce44e4-17b7-4bd1-a6d1-04996ec95633 |

+> | <a name='device-provisioning-service-data-reader'></a>[Device Provisioning Service Data Reader](./built-in-roles/internet-of-things.md#device-provisioning-service-data-reader) | Allows for full read access to Device Provisioning Service data-plane properties. | 10745317-c249-44a1-a5ce-3a4353c0bbd8 |

+> | <a name='firmware-analysis-admin'></a>[Firmware Analysis Admin](./built-in-roles/internet-of-things.md#firmware-analysis-admin) | Upload and analyze firmware images in Defender for IoT | 9c1607d1-791d-4c68-885d-c7b7aaff7c8a |

+> | <a name='api-management-developer-portal-content-editor'></a>[API Management Developer Portal Content Editor](./built-in-roles/integration.md#api-management-developer-portal-content-editor) | Can customize the developer portal, edit its content, and publish it. | c031e6a8-4391-4de0-8d69-4706a7ed3729 |

+> | <a name='app-configuration-contributor'></a>[App Configuration Contributor](./built-in-roles/integration.md#app-configuration-contributor) | Grants permission for all management operations, except purge, for App Configuration resources. | fe86443c-f201-4fc4-9d2a-ac61149fbda0 |

+> | <a name='app-configuration-reader'></a>[App Configuration Reader](./built-in-roles/integration.md#app-configuration-reader) | Grants permission for read operations for App Configuration resources. | 175b81b9-6e0d-490a-85e4-0d422273c10c |

+> | <a name='azure-resource-notifications-system-topics-subscriber'></a>[Azure Resource Notifications System Topics Subscriber](./built-in-roles/integration.md#azure-resource-notifications-system-topics-subscriber) | Lets you create system topics and event subscriptions on all system topics exposed currently and in the future by Azure Resource Notifications | 0b962ed2-6d56-471c-bd5f-3477d83a7ba4 |

+> | <a name='chamber-admin'></a>[Chamber Admin](./built-in-roles/integration.md#chamber-admin) | Lets you manage everything under your Modeling and Simulation Workbench chamber. | 4e9b8407-af2e-495b-ae54-bb60a55b1b5a |

+> | <a name='chamber-user'></a>[Chamber User](./built-in-roles/integration.md#chamber-user) | Lets you view everything under your Modeling and Simulation Workbench chamber, but not make any changes. | 4447db05-44ed-4da3-ae60-6cbece780e32 |

+> | <a name='dicom-data-owner'></a>[DICOM Data Owner](./built-in-roles/integration.md#dicom-data-owner) | Full access to DICOM data. | 58a3b984-7adf-4c20-983a-32417c86fbc8 |

+> | <a name='dicom-data-reader'></a>[DICOM Data Reader](./built-in-roles/integration.md#dicom-data-reader) | Read and search DICOM data. | e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a |

+> | <a name='eventgrid-topicspaces-publisher'></a>[EventGrid TopicSpaces Publisher](./built-in-roles/integration.md#eventgrid-topicspaces-publisher) | Lets you publish messages on topicspaces. | a12b0b94-b317-4dcd-84a8-502ce99884c6 |

+> | <a name='eventgrid-topicspaces-subscriber'></a>[EventGrid TopicSpaces Subscriber](./built-in-roles/integration.md#eventgrid-topicspaces-subscriber) | Lets you subscribe messages on topicspaces. | 4b0f2fd7-60b4-4eca-896f-4435034f8bf5 |

+> | <a name='fhir-data-converter'></a>[FHIR Data Converter](./built-in-roles/integration.md#fhir-data-converter) | Role allows user or principal to convert data from legacy format to FHIR | a1705bd2-3a8f-45a5-8683-466fcfd5cc24 |

+> | <a name='fhir-smart-user'></a>[FHIR SMART User](./built-in-roles/integration.md#fhir-smart-user) | Role allows user to access FHIR Service according to SMART on FHIR specification | 4ba50f17-9666-485c-a643-ff00808643f0 |

+> | <a name='deployment-environments-reader'></a>[Deployment Environments Reader](./built-in-roles/devops.md#deployment-environments-reader) | Provides read access to environment resources. | eb960402-bf75-4cc3-8d68-35b34f960f72 |

+> | <a name='deployment-environments-user'></a>[Deployment Environments User](./built-in-roles/devops.md#deployment-environments-user) | Provides access to manage environment resources. | 18e40d4e-8d2e-438d-97e1-9528336e149c |

+> | <a name='devcenter-dev-box-user'></a>[DevCenter Dev Box User](./built-in-roles/devops.md#devcenter-dev-box-user) | Provides access to create and manage dev boxes. | 45d50f46-0b78-4001-a660-4198cbe8cd05 |

+> | <a name='devcenter-project-admin'></a>[DevCenter Project Admin](./built-in-roles/devops.md#devcenter-project-admin) | Provides access to manage project resources. | 331c37c6-af14-46d9-b9f4-e1909e1b95a0 |

+> | <a name='advisor-recommendations-contributor-assessments-and-reviews'></a>[Advisor Recommendations Contributor (Assessments and Reviews)](./built-in-roles/management-and-governance.md#advisor-recommendations-contributor-assessments-and-reviews) | View assessment recommendations, accepted review recommendations, and manage the recommendations lifecycle (mark recommendations as completed, postponed or dismissed, in progress, or not started). | 6b534d80-e337-47c4-864f-140f5c7f593d |

+> | <a name='advisor-reviews-contributor'></a>[Advisor Reviews Contributor](./built-in-roles/management-and-governance.md#advisor-reviews-contributor) | View reviews for a workload and triage recommendations linked to them. | 8aac15f0-d885-4138-8afa-bfb5872f7d13 |

+> | <a name='advisor-reviews-reader'></a>[Advisor Reviews Reader](./built-in-roles/management-and-governance.md#advisor-reviews-reader) | View reviews for a workload and recommendations linked to them. | c64499e0-74c3-47ad-921c-13865957895c |

+> | <a name='azure-center-for-sap-solutions-administrator'></a>[Azure Center for SAP solutions administrator](./built-in-roles/management-and-governance.md#azure-center-for-sap-solutions-administrator) | This role provides read and write access to all capabilities of Azure Center for SAP solutions. | 7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7 |

+> | <a name='azure-center-for-sap-solutions-reader'></a>[Azure Center for SAP solutions reader](./built-in-roles/management-and-governance.md#azure-center-for-sap-solutions-reader) | This role provides read access to all capabilities of Azure Center for SAP solutions. | 05352d14-a920-4328-a0de-4cbe7430e26b |

+> | <a name='azure-center-for-sap-solutions-service-role'></a>[Azure Center for SAP solutions service role](./built-in-roles/management-and-governance.md#azure-center-for-sap-solutions-service-role) | Azure Center for SAP solutions service role - This role is intended to be used for providing the permissions to user assigned managed identity. Azure Center for SAP solutions will use this identity to deploy and manage SAP systems. | aabbc5dd-1af0-458b-a942-81af88f9c138 |

+> | <a name='azure-customer-lockbox-approver-for-subscription'></a>[Azure Customer Lockbox Approver for Subscription](./built-in-roles/management-and-governance.md#azure-customer-lockbox-approver-for-subscription) | Can approve Microsoft support requests to access specific resources contained within a subscription, or the subscription itself, when Customer Lockbox for Microsoft Azure is enabled on the tenant where the subscription resides. | 4dae6930-7baf-46f5-909e-0383bc931c46 |

+> | <a name='savings-plan-purchaser'></a>[Savings plan Purchaser](./built-in-roles/management-and-governance.md#savings-plan-purchaser) | Lets you purchase savings plans | 3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74 |

+> | <a name='hybrid-server-resource-administrator'></a>[Hybrid Server Resource Administrator](./built-in-roles/hybrid-multicloud.md#hybrid-server-resource-administrator) | Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider. | 48b40c6e-82e0-4eb3-90d5-19e40f49b624 |

+## AgFood Platform Sensor Partner Contributor

+Provides contribute access to manage sensor related entities in AgFood Platform Service

+[Learn more](/azure/data-manager-for-agri/how-to-set-up-sensors-customer)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/sensorPartnerScope/* | |

+> | **NotDataActions** | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/sensorPartnerScope/sensors/delete | Deletes an existing AgFoodPlatform sensors resource restricted to caller's sensor partner scope. |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides contribute access to manage sensor related entities in AgFood Platform Service",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/6b77f0a0-0d89-41cc-acd1-579c22c17a67",

+ "name": "6b77f0a0-0d89-41cc-acd1-579c22c17a67",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"

+ ],

+ "notDataActions": [

+ "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/sensors/delete"

+ ]

+ }

+ ],

+ "roleName": "AgFood Platform Sensor Partner Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## AgFood Platform Service Admin

+Provides admin access to AgFood Platform Service

+[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/* | Create, update, read and delete any AgFood Platform resources. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides admin access to AgFood Platform Service",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f8da80de-1ff9-4747-ad80-a19b7f6079e3",

+ "name": "f8da80de-1ff9-4747-ad80-a19b7f6079e3",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.AgFoodPlatform/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "AgFood Platform Service Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## AgFood Platform Service Contributor

+Provides contribute access to AgFood Platform Service

+[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/action | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/read | Read any AgFood Platform resources. |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/write | Create and update any AgFood Platform resources. |

+> | **NotDataActions** | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/farmers/write | Creates or Updates AgFoodPlatform farmers. |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/deletionJobs/*/write | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/parties/write | Creates or Updates AgFoodPlatform parties. |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasets/write | Creates or Updates AgFoodPlatform datasets. |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasetRecords/write | Creates or Updates AgFoodPlatform Dataset Records. |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/farmBeats/datasets/access/*/action | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides contribute access to AgFood Platform Service",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/8508508a-4469-4e45-963b-2518ee0bb728",

+ "name": "8508508a-4469-4e45-963b-2518ee0bb728",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.AgFoodPlatform/*/action",

+ "Microsoft.AgFoodPlatform/*/read",

+ "Microsoft.AgFoodPlatform/*/write"

+ ],

+ "notDataActions": [

+ "Microsoft.AgFoodPlatform/farmBeats/farmers/write",

+ "Microsoft.AgFoodPlatform/farmBeats/deletionJobs/*/write",

+ "Microsoft.AgFoodPlatform/farmBeats/parties/write",

+ "Microsoft.AgFoodPlatform/farmBeats/datasets/write",

+ "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/write",

+ "Microsoft.AgFoodPlatform/farmBeats/datasets/access/*/action"

+ ]

+ }

+ ],

+ "roleName": "AgFood Platform Service Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## AgFood Platform Service Reader

+Provides read access to AgFood Platform Service

+[Learn more](/azure/data-manager-for-agri/quickstart-install-data-manager-for-agriculture)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/list/action | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/read | Read any AgFood Platform resources. |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/search/action | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/download/action | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/overlap/action | |

+> | [Microsoft.AgFoodPlatform](../permissions/ai-machine-learning.md#microsoftagfoodplatform)/*/checkConsent/action | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides read access to AgFood Platform Service",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",

+ "name": "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.AgFoodPlatform/*/list/action",

+ "Microsoft.AgFoodPlatform/*/read",

+ "Microsoft.AgFoodPlatform/*/search/action",

+ "Microsoft.AgFoodPlatform/*/download/action",

+ "Microsoft.AgFoodPlatform/*/overlap/action",

+ "Microsoft.AgFoodPlatform/*/checkConsent/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "AgFood Platform Service Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## AzureML Metrics Writer (preview)

+Lets you write metrics to AzureML workspace

+[Learn more](/azure/machine-learning/concept-endpoints-online-auth)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/workspaces/metrics/*/write | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Lets you write metrics to AzureML workspace",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/635dd51f-9968-44d3-b7fb-6d9a6bd613ae",

+ "name": "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.MachineLearningServices/workspaces/metrics/*/write"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "AzureML Metrics Writer (preview)",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## AzureML Registry User

+Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.

+[Learn more](/azure/machine-learning/how-to-assign-roles)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/read | Gets the Machine Learning Services registry(ies) |

+> | [Microsoft.MachineLearningServices](../permissions/ai-machine-learning.md#microsoftmachinelearningservices)/registries/assets/* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/1823dd4f-9b8c-4ab6-ab4e-7397a3684615",

+ "name": "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.MachineLearningServices/registries/read",

+ "Microsoft.MachineLearningServices/registries/assets/*"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "AzureML Registry User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services Immersive Reader User

+Provides access to create Immersive Reader sessions and call APIs

+[Learn more](/azure/ai-services/immersive-reader/security-how-to-update-role-assignment)

+> | *none* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ImmersiveReader/getcontentmodelforreader/action | Creates an Immersive Reader session |

+ "description": "Provides access to create Immersive Reader sessions and call APIs",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/b2de6794-95db-4659-8781-7e080d3f2b9d",

+ "name": "b2de6794-95db-4659-8781-7e080d3f2b9d",

+ "actions": [],

+ "Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action"

+ "roleName": "Cognitive Services Immersive Reader User",

+## Cognitive Services Language Owner

+Has access to all Read, Test, Write, Deploy and Delete functions under Language portal

+[Learn more](/azure/ai-services/language-service/concepts/role-based-access-control)

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/listkeys/action | List keys |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LanguageAuthoring/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ConversationalLanguageUnderstanding/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/TextAnalytics/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/TextAnalytics/QnaMaker/* | |

+ "description": "Has access to all Read, Test, Write, Deploy and Delete functions under Language portal",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f07febfe-79bc-46b1-8b37-790e26e6e498",

+ "name": "f07febfe-79bc-46b1-8b37-790e26e6e498",

+ "Microsoft.CognitiveServices/accounts/listkeys/action",

+ "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",

+ "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",

+ "Microsoft.CognitiveServices/accounts/Language/*",

+ "Microsoft.CognitiveServices/accounts/TextAnalytics/*"

+ "notDataActions": [

+ "Microsoft.CognitiveServices/accounts/TextAnalytics/QnaMaker/*"

+ ]

+ "roleName": "Cognitive Services Language Owner",

+## Cognitive Services Language Reader

+Has access to Read and Test functions under Language portal

+[Learn more](/azure/ai-services/language-service/concepts/role-based-access-control)

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LanguageAuthoring/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ConversationalLanguageUnderstanding/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ConversationalLanguageUnderstanding/projects/export/action | Triggers a job to export project data in JSON format. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/*/projects/export/action | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/query-text/action | Answer Text. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/query-dataverse/action | Query Dataverse. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/analyze-text/jobs/action | Submit a collection of text documents for analysis. Specify one or more unique tasks to be executed. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/analyze-text/action | Submit a collection of text documents for analysis. Specify a single unique task to be executed immediately. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/analyze-text/jobscancel/action | Cancel a long-running Text Analysis job. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/analyze-conversations/action | Analyzes the input conversation. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/analyze-conversations/jobscancel/action | Cancel a long-running analysis job on conversation. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/analyze-conversations/jobs/action | Submit a long conversation for analysis. Specify one or more unique tasks to be executed as a long-running operation. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/query-knowledgebases/action | Answer Knowledgebase. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/generate/action | Language generation. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/TextAnalytics/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/TextAnalytics/QnaMaker/* | |

+ "description": "Has access to Read and Test functions under Language portal",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/7628b7b8-a8b2-4cdc-b46f-e9b35248918e",

+ "name": "7628b7b8-a8b2-4cdc-b46f-e9b35248918e",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*/read",

+ "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*/read",

+ "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/projects/export/action",

+ "Microsoft.CognitiveServices/accounts/Language/*/read",

+ "Microsoft.CognitiveServices/accounts/Language/*/projects/export/action",

+ "Microsoft.CognitiveServices/accounts/Language/query-text/action",

+ "Microsoft.CognitiveServices/accounts/Language/query-dataverse/action",

+ "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/action",

+ "Microsoft.CognitiveServices/accounts/Language/analyze-text/action",

+ "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobscancel/action",

+ "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/action",

+ "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobscancel/action",

+ "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobs/action",

+ "Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/action",

+ "Microsoft.CognitiveServices/accounts/Language/generate/action",

+ "Microsoft.CognitiveServices/accounts/TextAnalytics/*"

+ ],

+ "notDataActions": [

+ "Microsoft.CognitiveServices/accounts/TextAnalytics/QnaMaker/*"

+ ]

+ }

+ ],

+ "roleName": "Cognitive Services Language Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services Language Writer

+ Has access to all Read, Test, and Write functions under Language Portal

+[Learn more](/azure/ai-services/language-service/concepts/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LanguageAuthoring/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ConversationalLanguageUnderstanding/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/TextAnalytics/* | |

+> | **NotDataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LanguageAuthoring/projects/publish/action | Trigger publishing job. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/ConversationalLanguageUnderstanding/projects/deployments/write | Trigger job to create new deployment or replace an existing deployment. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/TextAnalytics/QnaMaker/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/*/projects/delete | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/*/projects/deployments/write | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/*/projects/deployments/delete | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/Language/*/projects/deployments/swap/action | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": " Has access to all Read, Test, and Write functions under Language Portal",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f2310ca1-dc64-4889-bb49-c8e0fa3d47a8",

+ "name": "f2310ca1-dc64-4889-bb49-c8e0fa3d47a8",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",

+ "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",

+ "Microsoft.CognitiveServices/accounts/Language/*",

+ "Microsoft.CognitiveServices/accounts/TextAnalytics/*"

+ ],

+ "notDataActions": [

+ "Microsoft.CognitiveServices/accounts/LanguageAuthoring/projects/publish/action",

+ "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/projects/deployments/write",

+ "Microsoft.CognitiveServices/accounts/TextAnalytics/QnaMaker/*",

+ "Microsoft.CognitiveServices/accounts/Language/*/projects/delete",

+ "Microsoft.CognitiveServices/accounts/Language/*/projects/deployments/write",

+ "Microsoft.CognitiveServices/accounts/Language/*/projects/deployments/delete",

+ "Microsoft.CognitiveServices/accounts/Language/*/projects/deployments/swap/action"

+ ]

+ }

+ ],

+ "roleName": "Cognitive Services Language Writer",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services LUIS Owner

+ Has access to all Read, Test, Write, Deploy and Delete functions under LUIS

+[Learn more](/azure/ai-services/luis/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/listkeys/action | List keys |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": " Has access to all Read, Test, Write, Deploy and Delete functions under LUIS",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f72c8140-2111-481c-87ff-72b910f6e3f8",

+ "name": "f72c8140-2111-481c-87ff-72b910f6e3f8",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.CognitiveServices/accounts/listkeys/action",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/LUIS/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Cognitive Services LUIS Owner",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services LUIS Reader

+Has access to Read and Test functions under LUIS.

+[Learn more](/azure/ai-services/luis/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/testdatasets/write | Updates last test results of an exisiting batch test data set for a given application. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Has access to Read and Test functions under LUIS.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/18e81cdc-4e98-4e29-a639-e7d10c5a6226",

+ "name": "18e81cdc-4e98-4e29-a639-e7d10c5a6226",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/LUIS/*/read",

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/testdatasets/write"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Cognitive Services LUIS Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services LUIS Writer

+Has access to all Read, Test, and Write functions under LUIS

+[Learn more](/azure/ai-services/luis/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/* | |

+> | **NotDataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/delete | Deletes an application. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/move/action | Moves the app to a different LUIS authoring Azure resource. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/publish/action | Publishes a specific version of the application. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/settings/write | Updates the application settings |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/azureaccounts/action | Assigns an Azure account to the application. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/LUIS/apps/azureaccounts/delete | Gets the LUIS Azure accounts for the user using his Azure Resource Manager token. |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Has access to all Read, Test, and Write functions under LUIS",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/6322a993-d5c9-4bed-b113-e49bbea25b27",

+ "name": "6322a993-d5c9-4bed-b113-e49bbea25b27",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/LUIS/*"

+ ],

+ "notDataActions": [

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/delete",

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/move/action",

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/publish/action",

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/settings/write",

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/azureaccounts/action",

+ "Microsoft.CognitiveServices/accounts/LUIS/apps/azureaccounts/delete"

+ ]

+ }

+ ],

+ "roleName": "Cognitive Services LUIS Writer",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services Metrics Advisor Administrator

+Full access to the project, including the system level configuration.

+[Learn more](/azure/ai-services/metrics-advisor/how-tos/alerts)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MetricsAdvisor/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Full access to the project, including the system level configuration.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/cb43c632-a144-4ec5-977c-e80c4affc34a",

+ "name": "cb43c632-a144-4ec5-977c-e80c4affc34a",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Cognitive Services Metrics Advisor Administrator",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services Metrics Advisor User

+Access to the project.

+[Learn more](/dotnet/api/overview/azure/ai.metricsadvisor-readme)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MetricsAdvisor/* | |

+> | **NotDataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/MetricsAdvisor/stats/* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Access to the project.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/3b20f47b-3825-43cb-8114-4bd2201156a8",

+ "name": "3b20f47b-3825-43cb-8114-4bd2201156a8",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"

+ ],

+ "notDataActions": [

+ "Microsoft.CognitiveServices/accounts/MetricsAdvisor/stats/*"

+ ]

+ }

+ ],

+ "roleName": "Cognitive Services Metrics Advisor User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services OpenAI Contributor

+Full access including the ability to fine-tune, deploy and generate text

+[Learn more](/azure/ai-services/openai/how-to/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/deployments/write | Writes deployments. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/deployments/delete | Deletes deployments. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/raiPolicies/read | Gets all applicable policies under the account including default policies. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/raiPolicies/write | Create or update a custom Responsible AI policy. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/raiPolicies/delete | Deletes a custom Responsible AI policy that's not referenced by an existing deployment. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/commitmentplans/read | Reads commitment plans. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/commitmentplans/write | Writes commitment plans. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/commitmentplans/delete | Deletes commitment plans. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Full access including the ability to fine-tune, deploy and generate text",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/a001fd3d-188f-4b5d-821b-7da978bf7442",

+ "name": "a001fd3d-188f-4b5d-821b-7da978bf7442",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.CognitiveServices/accounts/deployments/write",

+ "Microsoft.CognitiveServices/accounts/deployments/delete",

+ "Microsoft.CognitiveServices/accounts/raiPolicies/read",

+ "Microsoft.CognitiveServices/accounts/raiPolicies/write",

+ "Microsoft.CognitiveServices/accounts/raiPolicies/delete",

+ "Microsoft.CognitiveServices/accounts/commitmentplans/read",

+ "Microsoft.CognitiveServices/accounts/commitmentplans/write",

+ "Microsoft.CognitiveServices/accounts/commitmentplans/delete",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/OpenAI/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Cognitive Services OpenAI Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services OpenAI User

+Read access to view files, models, deployments. The ability to create completion and embedding calls.

+[Learn more](/azure/ai-services/openai/how-to/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/engines/completions/action | Create a completion from a chosen model |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/engines/search/action | Search for the most relevant documents using the current engine. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/engines/generate/action | (Intended for browsers only.) Stream generated text from the model via GET request. This method is provided because the browser-native EventSource method can only send GET requests. It supports a more limited set of configuration options than the POST variant. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/deployments/audio/action | Return the transcript or translation for a given audio file. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/deployments/search/action | Search for the most relevant documents using the current engine. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/deployments/completions/action | Create a completion from a chosen model. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/deployments/chat/completions/action | Creates a completion for the chat message |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/deployments/extensions/chat/completions/action | Creates a completion for the chat message with extensions |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/deployments/embeddings/action | Return the embeddings for a given prompt. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/OpenAI/images/generations/action | Create image generations. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Ability to view files, models, deployments. Readers can't make any changes They can inference and create images",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",

+## Cognitive Services Speech Contributor

+Full access to Speech projects, including read, write and delete all entities, for real-time speech recognition and batch transcription tasks, real-time speech synthesis and long audio tasks, custom speech and custom voice.

+[Learn more](/azure/ai-services/speech-service/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVoice/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/AudioContentCreation/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/VideoTranslation/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomAvatar/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/BatchAvatar/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/BatchTextToSpeech/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Full access to Speech projects, including read, write and delete all entities, for real-time speech recognition and batch transcription tasks, real-time speech synthesis and long audio tasks, custom speech and custom voice.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/0e75ca1e-0464-4b4d-8b93-68208a576181",

+ "name": "0e75ca1e-0464-4b4d-8b93-68208a576181",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/SpeechServices/*",

+ "Microsoft.CognitiveServices/accounts/CustomVoice/*",

+ "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",

+ "Microsoft.CognitiveServices/accounts/VideoTranslation/*",

+ "Microsoft.CognitiveServices/accounts/CustomAvatar/*",

+ "Microsoft.CognitiveServices/accounts/BatchAvatar/*",

+ "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Cognitive Services Speech Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Cognitive Services Speech User

+Access to the real-time speech recognition and batch transcription APIs, real-time speech synthesis and long audio APIs, as well as to read the data/test/model/endpoint for custom models, but can't create, delete or modify the data/test/model/endpoint for custom models.

+[Learn more](/azure/ai-services/speech-service/role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleDefinitions/read | Get information about a role definition. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/*/transcriptions/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/*/transcriptions/write | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/*/transcriptions/delete | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/*/frontend/action | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/text-dependent/*/action | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/SpeechServices/text-independent/*/action | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVoice/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVoice/evaluations/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVoice/longaudiosynthesis/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/AudioContentCreation/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/VideoTranslation/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomAvatar/*/read | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/BatchAvatar/* | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/BatchTextToSpeech/* | |

+> | **NotDataActions** | |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVoice/datasets/files/read | Gets the files of the dataset identified by the given ID. |

+> | [Microsoft.CognitiveServices](../permissions/ai-machine-learning.md#microsoftcognitiveservices)/accounts/CustomVoice/datasets/utterances/read | Gets utterances of the specified training set. |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Access to the real-time speech recognition and batch transcription APIs, real-time speech synthesis and long audio APIs, as well as to read the data/test/model/endpoint for custom models, but can't create, delete or modify the data/test/model/endpoint for custom models.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f2dc8367-1007-4938-bd23-fe263f013447",

+ "name": "f2dc8367-1007-4938-bd23-fe263f013447",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.CognitiveServices/*/read",

+ "Microsoft.Authorization/roleAssignments/read",

+ "Microsoft.Authorization/roleDefinitions/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.CognitiveServices/accounts/SpeechServices/*/read",

+ "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/read",

+ "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/write",

+ "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/delete",

+ "Microsoft.CognitiveServices/accounts/SpeechServices/*/frontend/action",

+ "Microsoft.CognitiveServices/accounts/SpeechServices/text-dependent/*/action",

+ "Microsoft.CognitiveServices/accounts/SpeechServices/text-independent/*/action",

+ "Microsoft.CognitiveServices/accounts/CustomVoice/*/read",

+ "Microsoft.CognitiveServices/accounts/CustomVoice/evaluations/*",

+ "Microsoft.CognitiveServices/accounts/CustomVoice/longaudiosynthesis/*",

+ "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",

+ "Microsoft.CognitiveServices/accounts/VideoTranslation/*",

+ "Microsoft.CognitiveServices/accounts/CustomAvatar/*/read",

+ "Microsoft.CognitiveServices/accounts/BatchAvatar/*",

+ "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"

+ ],

+ "notDataActions": [

+ "Microsoft.CognitiveServices/accounts/CustomVoice/datasets/files/read",

+ "Microsoft.CognitiveServices/accounts/CustomVoice/datasets/utterances/read"

+ ]

+ }

+ ],

+ "roleName": "Cognitive Services Speech User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Health Bot Admin

+Users with admin access can sign in, view and edit all of the bot resources, scenarios and configuration setting including the bot instance keys & secrets.

+[Learn more](/azure/health-bot/portal-users)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthBot](../permissions/ai-machine-learning.md#microsofthealthbot)/healthBots/Admin/Action | Sign in to the management portal, view and edit all of the bot resources, scenarios, configuration settings, instance keys & secrets. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Users with admin access can sign in, view and edit all of the bot resources, scenarios and configuration setting including the bot instance keys & secrets.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/f1082fec-a70f-419f-9230-885d2550fb38",

+ "name": "f1082fec-a70f-419f-9230-885d2550fb38",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthBot/healthBots/Admin/Action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Health Bot Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Health Bot Editor

+Users with editor access can sign in, view and edit all the bot resources, scenarios and configuration setting except for the bot instance keys & secrets and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). A read-only access to the bot skills and channels.

+[Learn more](/azure/health-bot/portal-users)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthBot](../permissions/ai-machine-learning.md#microsofthealthbot)/healthBots/Editor/Action | Sign in to the management portal, view and edit all the bot resources, scenarios and configuration settings except for the bot instance keys & secrets and the end-user inputs. Read-only access to the bot skills and channels. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Users with editor access can sign in, view and edit all the bot resources, scenarios and configuration setting except for the bot instance keys & secrets and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). A read-only access to the bot skills and channels.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/af854a69-80ce-4ff7-8447-f1118a2e0ca8",

+ "name": "af854a69-80ce-4ff7-8447-f1118a2e0ca8",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthBot/healthBots/Editor/Action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Health Bot Editor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Health Bot Reader

+Users with reader access can sign in, have read-only access to the bot resources, scenarios and configuration setting except for the bot instance keys & secrets (including Authentication, Data Connection and Channels keys) and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs).

+[Learn more](/azure/health-bot/portal-users)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthBot](../permissions/ai-machine-learning.md#microsofthealthbot)/healthBots/Reader/Action | Sign in to the management portal, with read-only access to resources, scenarios and configuration settings except for the bot instance keys & secrets and the end-user inputs. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Users with reader access can sign in, have read-only access to the bot resources, scenarios and configuration setting except for the bot instance keys & secrets (including Authentication, Data Connection and Channels keys) and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs).",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/eb5a76d5-50e7-4c33-a449-070e7c9c4cf2",

+ "name": "eb5a76d5-50e7-4c33-a449-070e7c9c4cf2",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthBot/healthBots/Reader/Action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Health Bot Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## HDInsight on AKS Cluster Admin

+Grants a user/group the ability to create, delete and manage clusters within a given cluster pool. Cluster Admin can also run workloads, monitor, and manage all user activity on these clusters.

+[Learn more](/azure/hdinsight-aks/hdinsight-on-aks-manage-authorization-profile)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/read | Get details about HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/write | Create or Update HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/delete | Delete a HDInsight on AKS cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/resize/action | Resize a HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterpools/clusters/instanceviews/read | Get details about HDInsight on AKS Cluster Instance View |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/jobs/read | List HDInsight on AKS Cluster Jobs |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/runjob/action | Run HDInsight on AKS Cluster Job |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterpools/clusters/serviceconfigs/read | Get details about HDInsight on AKS Cluster Service Configurations |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/availableupgrades/read | Get Avaliable Upgrades for HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/upgrade/action | Upgrade HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/rollback/action | Rollback HDInsight on AKS Cluster Upgrade |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/upgradehistories/read | Read HDInsight on AKS Cluster Upgrade Histories |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/libraries/read | Read HDInsight on AKS Cluster Libaries |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/managelibraries/action | Manage HDInsight on AKS Cluster Libaries |

+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/*/read | |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logs/read | Reading data from all your logs |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Grants a user/group the ability to create, delete and manage clusters within a given cluster pool. Cluster Admin can also run workloads, monitor, and manage all user activity on these clusters.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/fd036e6b-1266-47a0-b0bb-a05d04831731",

+ "name": "fd036e6b-1266-47a0-b0bb-a05d04831731",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Authorization/*/read",

+ "Microsoft.HDInsight/clusterPools/clusters/read",

+ "Microsoft.HDInsight/clusterPools/clusters/write",

+ "Microsoft.HDInsight/clusterPools/clusters/delete",

+ "Microsoft.HDInsight/clusterPools/clusters/resize/action",

+ "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",

+ "Microsoft.HDInsight/clusterPools/clusters/jobs/read",

+ "Microsoft.HDInsight/clusterPools/clusters/runjob/action",

+ "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",

+ "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",

+ "Microsoft.HDInsight/clusterPools/clusters/upgrade/action",

+ "Microsoft.HDInsight/clusterPools/clusters/rollback/action",

+ "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",

+ "Microsoft.HDInsight/clusterPools/clusters/libraries/read",

+ "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",

+ "Microsoft.ResourceHealth/availabilityStatuses/read",

+ "Microsoft.Resources/deployments/operations/read",

+ "Microsoft.Resources/deployments/*/read",

+ "Microsoft.Resources/deployments/read",

+ "Microsoft.Resources/deployments/validate/action",

+ "Microsoft.Resources/deployments/write",

+ "Microsoft.Resources/deployments/exportTemplate/action",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.Resources/subscriptions/operationresults/read",

+ "Microsoft.Insights/AlertRules/Write",

+ "Microsoft.Insights/AlertRules/Delete",

+ "Microsoft.Insights/AlertRules/Read",

+ "Microsoft.Insights/AlertRules/Activated/Action",

+ "Microsoft.Insights/AlertRules/Resolved/Action",

+ "Microsoft.Insights/AlertRules/Throttled/Action",

+ "Microsoft.Insights/AlertRules/Incidents/Read",

+ "Microsoft.Insights/metrics/read",

+ "Microsoft.Insights/logs/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "HDInsight on AKS Cluster Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## HDInsight on AKS Cluster Pool Admin

+Can read, create, modify and delete HDInsight on AKS cluster pools and create clusters

+[Learn more](/azure/hdinsight-aks/hdinsight-on-aks-manage-authorization-profile)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/read | Get details about HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/clusters/write | Create or Update HDInsight on AKS Cluster |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/delete | Delete a HDInsight on AKS Cluster Pool |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/read | Get details about HDInsight on AKS Cluster Pool |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/write | Create or Update HDInsight on AKS Cluster Pool |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterpools/availableupgrades/read | Get Avaliable Upgrades for HDInsight on AKS Cluster Pool |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterpools/upgrade/action | Upgrade HDInsight on AKS Cluster Pool |

+> | [Microsoft.HDInsight](../permissions/analytics.md#microsofthdinsight)/clusterPools/upgradehistories/read | Read HDInsight on AKS Cluster Pool Upgrade Histories |

+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/*/read | |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/logs/read | Reading data from all your logs |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Can read, create, modify and delete HDInsight on AKS cluster pools and create clusters",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/7656b436-37d4-490a-a4ab-d39f838f0042",

+ "name": "7656b436-37d4-490a-a4ab-d39f838f0042",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Authorization/*/read",

+ "Microsoft.HDInsight/clusterPools/clusters/read",

+ "Microsoft.HDInsight/clusterPools/clusters/write",

+ "Microsoft.HDInsight/clusterPools/delete",

+ "Microsoft.HDInsight/clusterPools/read",

+ "Microsoft.HDInsight/clusterPools/write",

+ "Microsoft.HDInsight/clusterpools/availableupgrades/read",

+ "Microsoft.HDInsight/clusterpools/upgrade/action",

+ "Microsoft.HDInsight/clusterPools/upgradehistories/read",

+ "Microsoft.ResourceHealth/availabilityStatuses/read",

+ "Microsoft.Resources/deployments/operations/read",

+ "Microsoft.Resources/deployments/validate/action",

+ "Microsoft.Resources/deployments/*/read",

+ "Microsoft.Resources/deployments/read",

+ "Microsoft.Resources/deployments/write",

+ "Microsoft.Resources/deployments/exportTemplate/action",

+ "Microsoft.Resources/deployments/validate/action",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.Resources/subscriptions/operationresults/read",

+ "Microsoft.Insights/AlertRules/Write",

+ "Microsoft.Insights/AlertRules/Delete",

+ "Microsoft.Insights/AlertRules/Read",

+ "Microsoft.Insights/AlertRules/Activated/Action",

+ "Microsoft.Insights/AlertRules/Resolved/Action",

+ "Microsoft.Insights/AlertRules/Throttled/Action",

+ "Microsoft.Insights/AlertRules/Incidents/Read",

+ "Microsoft.Insights/metrics/read",

+ "Microsoft.Insights/logs/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "HDInsight on AKS Cluster Pool Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Azure Arc VMware VM Contributor

+Arc VMware VM Contributor has permissions to perform all VM actions.

+[Learn more](/azure/azure-arc/vmware-vsphere/setup-and-manage-self-service-access)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachines/* | |

+> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachineinstances/* | |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |

+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/UpgradeExtensions/action | Upgrades Extensions on Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/assessPatches/action | Assesses any Azure Arc machines to get missing software patches |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/installPatches/action | Installs patches on any Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/read | Reads any Azure Arc extensions |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/write | Installs or Updates an Azure Arc extensions |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/delete | Deletes an Azure Arc extensions |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/read | Reads any Azure Arc patchAssessmentResults |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/softwarePatches/read | Reads any Azure Arc patchAssessmentResults/softwarePatches |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/read | Reads any Azure Arc patchInstallationResults |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/softwarePatches/read | Reads any Azure Arc patchInstallationResults/softwarePatches |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/updateCenterOperationResults/read | Reads the status of an update center operation on machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/hybridIdentityMetadata/read | Read any Azure Arc machines's Hybrid Identity Metadata |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/read | Read all Azure Connected Machine Agent versions available |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/latest/read | Read the latest Azure Connected Machine Agent version |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/read | Reads any Azure Arc runcommands |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/write | Installs or Updates an Azure Arc runcommands |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/delete | Deletes an Azure Arc runcommands |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/read | Reads any Azure Arc licenseProfiles |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/write | Installs or Updates an Azure Arc licenseProfiles |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/delete | Deletes an Azure Arc licenseProfiles |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Arc VMware VM Contributor has permissions to perform all VM actions.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/b748a06d-6150-4f8a-aaa9-ce3940cd96cb",

+ "name": "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",

+ "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",

+ "Microsoft.Insights/AlertRules/Write",

+ "Microsoft.Insights/AlertRules/Delete",

+ "Microsoft.Insights/AlertRules/Read",

+ "Microsoft.Insights/AlertRules/Activated/Action",

+ "Microsoft.Insights/AlertRules/Resolved/Action",

+ "Microsoft.Insights/AlertRules/Throttled/Action",

+ "Microsoft.Insights/AlertRules/Incidents/Read",

+ "Microsoft.Resources/deployments/read",

+ "Microsoft.Resources/deployments/write",

+ "Microsoft.Resources/deployments/delete",

+ "Microsoft.Resources/deployments/cancel/action",

+ "Microsoft.Resources/deployments/validate/action",

+ "Microsoft.Resources/deployments/whatIf/action",

+ "Microsoft.Resources/deployments/exportTemplate/action",

+ "Microsoft.Resources/deployments/operations/read",

+ "Microsoft.Resources/deployments/operationstatuses/read",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",

+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",

+ "Microsoft.ResourceHealth/availabilityStatuses/read",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/subscriptions/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.Resources/subscriptions/operationresults/read",

+ "Microsoft.HybridCompute/machines/read",

+ "Microsoft.HybridCompute/machines/write",

+ "Microsoft.HybridCompute/machines/delete",

+ "Microsoft.HybridCompute/machines/UpgradeExtensions/action",

+ "Microsoft.HybridCompute/machines/assessPatches/action",

+ "Microsoft.HybridCompute/machines/installPatches/action",

+ "Microsoft.HybridCompute/machines/extensions/read",

+ "Microsoft.HybridCompute/machines/extensions/write",

+ "Microsoft.HybridCompute/machines/extensions/delete",

+ "Microsoft.HybridCompute/operations/read",

+ "Microsoft.HybridCompute/locations/operationresults/read",

+ "Microsoft.HybridCompute/locations/operationstatus/read",

+ "Microsoft.HybridCompute/machines/patchAssessmentResults/read",

+ "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",

+ "Microsoft.HybridCompute/machines/patchInstallationResults/read",

+ "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",

+ "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",

+ "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",

+ "Microsoft.HybridCompute/osType/agentVersions/read",

+ "Microsoft.HybridCompute/osType/agentVersions/latest/read",

+ "Microsoft.HybridCompute/machines/runcommands/read",

+ "Microsoft.HybridCompute/machines/runcommands/write",

+ "Microsoft.HybridCompute/machines/runcommands/delete",

+ "Microsoft.HybridCompute/machines/licenseProfiles/read",

+ "Microsoft.HybridCompute/machines/licenseProfiles/write",

+ "Microsoft.HybridCompute/machines/licenseProfiles/delete",

+ "Microsoft.HybridCompute/licenses/read",

+ "Microsoft.HybridCompute/licenses/write",

+ "Microsoft.HybridCompute/licenses/delete"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Azure Arc VMware VM Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Desktop Virtualization Power On Contributor

+Provide permission to the Azure Virtual Desktop Resource Provider to start virtual machines.

+[Learn more](/azure/virtual-desktop/rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/start/action | Starts the virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/instanceView/read | Gets the detailed runtime status of the virtual machine and its resources |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/virtualMachineInstances/read | Gets/Lists virtual machine instance resource |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/virtualMachineInstances/start/action | Starts virtual machine instance resource |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/operations/read | Gets operations |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provide permission to the Azure Virtual Desktop Resource Provider to start virtual machines.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/489581de-a3bd-480d-9518-53dea7416b33",

+ "name": "489581de-a3bd-480d-9518-53dea7416b33",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Compute/virtualMachines/start/action",

+ "Microsoft.Compute/virtualMachines/read",

+ "Microsoft.Compute/virtualMachines/instanceView/read",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.HybridCompute/machines/read",

+ "Microsoft.HybridCompute/operations/read",

+ "Microsoft.HybridCompute/locations/operationresults/read",

+ "Microsoft.HybridCompute/locations/operationstatus/read",

+ "Microsoft.AzureStackHCI/virtualMachineInstances/read",

+ "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",

+ "Microsoft.AzureStackHCI/operations/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Desktop Virtualization Power On Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Desktop Virtualization Power On Off Contributor

+Provide permission to the Azure Virtual Desktop Resource Provider to start and stop virtual machines.

+[Learn more](/azure/virtual-desktop/rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/operations/read | Gets operations |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/virtualMachineInstances/read | Gets/Lists virtual machine instance resource |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/virtualMachineInstances/restart/action | Restarts virtual machine instance resource |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/virtualMachineInstances/start/action | Starts virtual machine instance resource |

+> | [Microsoft.AzureStackHCI](../permissions/hybrid-multicloud.md#microsoftazurestackhci)/virtualMachineInstances/stop/action | Stops virtual machine instance resource |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/deallocate/action | Powers off the virtual machine and releases the compute resources |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/instanceView/read | Gets the detailed runtime status of the virtual machine and its resources |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/powerOff/action | Powers off the virtual machine. Note that the virtual machine will continue to be billed. |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/restart/action | Restarts the virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/start/action | Starts the virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesCancelOperations/action | virtualMachinesCancelOperations: cancelOperations for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesExecuteDeallocate/action | virtualMachinesExecuteDeallocate: executeDeallocate for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesExecuteHibernate/action | virtualMachinesExecuteHibernate: executeHibernate for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesExecuteStart/action | virtualMachinesExecuteStart: executeStart for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesGetOperationErrors/action | |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesGetOperationStatus/action | virtualMachinesGetOperationStatus: getOperationStatus for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesSubmitDeallocate/action | virtualMachinesSubmitDeallocate: submitDeallocate for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesSubmitHibernate/action | virtualMachinesSubmitHibernate: submitHibernate for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/locations/virtualMachinesSubmitStart/action | virtualMachinesSubmitStart: submitStart for a virtual machine |

+> | [Microsoft.ComputeSchedule](../permissions/compute.md#microsoftcomputeschedule)/register/action | Register the subscription for Microsoft.ComputeSchedule |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/read | Read hostpools |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/read | Read hostpools/sessionhosts |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/usersessions/delete | Delete hostpools/sessionhosts/usersessions |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/usersessions/read | Read hostpools/sessionhosts/usersessions |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/usersessions/sendMessage/action | Send message to user session |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/write | Write hostpools/sessionhosts |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/write | Write hostpools |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/eventtypes/values/read | Read Activity Log events |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provide permission to the Azure Virtual Desktop Resource Provider to start and stop virtual machines.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/40c5ff49-9181-41f8-ae61-143b0e78555e",

+ "name": "40c5ff49-9181-41f8-ae61-143b0e78555e",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Authorization/*/read",

+ "Microsoft.AzureStackHCI/operations/read",

+ "Microsoft.AzureStackHCI/virtualMachineInstances/read",

+ "Microsoft.AzureStackHCI/virtualMachineInstances/restart/action",

+ "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",

+ "Microsoft.AzureStackHCI/virtualMachineInstances/stop/action",

+ "Microsoft.Compute/virtualMachines/deallocate/action",

+ "Microsoft.Compute/virtualMachines/instanceView/read",

+ "Microsoft.Compute/virtualMachines/powerOff/action",

+ "Microsoft.Compute/virtualMachines/read",

+ "Microsoft.Compute/virtualMachines/restart/action",

+ "Microsoft.Compute/virtualMachines/start/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",

+ "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",

+ "Microsoft.ComputeSchedule/register/action",

+ "Microsoft.DesktopVirtualization/hostpools/read",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",

+ "Microsoft.DesktopVirtualization/hostpools/write",

+ "Microsoft.HybridCompute/locations/operationresults/read",

+ "Microsoft.HybridCompute/locations/operationstatus/read",

+ "Microsoft.HybridCompute/machines/read",

+ "Microsoft.HybridCompute/operations/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Insights/eventtypes/values/read",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Desktop Virtualization Power On Off Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Desktop Virtualization Virtual Machine Contributor

+This role is in preview and subject to change. Provide permission to the Azure Virtual Desktop Resource Provider to create, delete, update, start, and stop virtual machines.

+[Learn more](/azure/virtual-desktop/rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/read | Read hostpools |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/write | Write hostpools |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/retrieveRegistrationToken/action | List registration tokens for host pool |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/read | Read hostpools/sessionhosts |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/write | Write hostpools/sessionhosts |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/delete | Delete hostpools/sessionhosts |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/usersessions/read | Read hostpools/sessionhosts/usersessions |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/usersessions/disconnect/action | Disconnects the user session form session host |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/usersessions/sendMessage/action | Send message to user session |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionHostConfigurations/read | Read hostpools/sessionhostconfigurations |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/doNotUseInternalAPI/action | Internal operation that is not meant to be called by customers. This will be removed in a future version. Do not use it. |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/retryprovisioning/action | Action on retryprovisioning. |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/read | Get the properties of an availability set |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/write | Creates a new availability set or updates an existing one |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/vmSizes/read | List available sizes for creating or updating a virtual machine in the availability set |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/read | Get the properties of a Disk |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/write | Creates a new Disk or updates an existing one |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/delete | Deletes the Disk |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/read | Gets the properties of Gallery |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/images/read | Gets the properties of Gallery Image |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/images/versions/read | Gets the properties of Gallery Image Version |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/images/read | Get the properties of the Image |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/usages/read | Gets service limits and current usage quantities for the subscription's compute resources in a location |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/vmSizes/read | Lists available virtual machine sizes in a location |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/operations/read | Lists operations available on Microsoft.Compute resource provider |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/skus/read | Gets the list of Microsoft.Compute SKUs available for your Subscription |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/delete | Deletes the virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/start/action | Starts the virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/powerOff/action | Powers off the virtual machine. Note that the virtual machine will continue to be billed. |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/restart/action | Restarts the virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/deallocate/action | Powers off the virtual machine and releases the compute resources |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/runCommand/action | Executes a predefined script on the virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/extensions/read | Get the properties of a virtual machine extension |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/extensions/write | Creates a new virtual machine extension or updates an existing one |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/extensions/delete | Deletes the virtual machine extension |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/runCommands/read | Get the properties of a virtual machine run command |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/runCommands/write | Creates a new virtual machine run command or updates an existing one |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/vmSizes/read | Lists available sizes the virtual machine can be updated to |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/read | Gets a network security group definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/write | Creates a network interface or updates an existing network interface. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/join/action | Joins a Virtual Machine to a network interface. Not Alertable. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/delete | Deletes a network interface |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/usages/read | Get the IP usages for each subnet of the virtual network |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/read | Gets a network security group definition |

+> | [Microsoft.Marketplace](../permissions/general.md#microsoftmarketplace)/offerTypes/publishers/offers/plans/agreements/read | Returns an Agreement. |

+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/deploy/action | Enables access to secrets in a key vault when deploying Azure resources |

+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/scalingPlans/read | Read scalingplans |

+> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/scalingPlans/write | Write scalingplans |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "This role is in preview and subject to change. Provide permission to the Azure Virtual Desktop Resource Provider to create, delete, update, start, and stop virtual machines.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/a959dbd1-f747-45e3-8ba6-dd80f235f97c",

+ "name": "a959dbd1-f747-45e3-8ba6-dd80f235f97c",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.DesktopVirtualization/hostpools/read",

+ "Microsoft.DesktopVirtualization/hostpools/write",

+ "Microsoft.DesktopVirtualization/hostpools/retrieveRegistrationToken/action",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/delete",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/disconnect/action",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",

+ "Microsoft.DesktopVirtualization/hostpools/sessionHostConfigurations/read",

+ "Microsoft.DesktopVirtualization/hostpools/doNotUseInternalAPI/action",

+ "Microsoft.DesktopVirtualization/hostpools/sessionhosts/retryprovisioning/action",

+ "Microsoft.Compute/availabilitySets/read",

+ "Microsoft.Compute/availabilitySets/write",

+ "Microsoft.Compute/availabilitySets/vmSizes/read",

+ "Microsoft.Compute/disks/read",

+ "Microsoft.Compute/disks/write",

+ "Microsoft.Compute/disks/delete",

+ "Microsoft.Compute/galleries/read",

+ "Microsoft.Compute/galleries/images/read",

+ "Microsoft.Compute/galleries/images/versions/read",

+ "Microsoft.Compute/images/read",

+ "Microsoft.Compute/locations/usages/read",

+ "Microsoft.Compute/locations/vmSizes/read",

+ "Microsoft.Compute/operations/read",

+ "Microsoft.Compute/skus/read",

+ "Microsoft.Compute/virtualMachines/read",

+ "Microsoft.Compute/virtualMachines/write",

+ "Microsoft.Compute/virtualMachines/delete",

+ "Microsoft.Compute/virtualMachines/start/action",

+ "Microsoft.Compute/virtualMachines/powerOff/action",

+ "Microsoft.Compute/virtualMachines/restart/action",

+ "Microsoft.Compute/virtualMachines/deallocate/action",

+ "Microsoft.Compute/virtualMachines/runCommand/action",

+ "Microsoft.Compute/virtualMachines/extensions/read",

+ "Microsoft.Compute/virtualMachines/extensions/write",

+ "Microsoft.Compute/virtualMachines/extensions/delete",

+ "Microsoft.Compute/virtualMachines/runCommands/read",

+ "Microsoft.Compute/virtualMachines/runCommands/write",

+ "Microsoft.Compute/virtualMachines/vmSizes/read",

+ "Microsoft.Network/networkSecurityGroups/read",

+ "Microsoft.Network/networkInterfaces/write",

+ "Microsoft.Network/networkInterfaces/read",

+ "Microsoft.Network/networkInterfaces/join/action",

+ "Microsoft.Network/networkInterfaces/delete",

+ "Microsoft.Network/virtualNetworks/subnets/read",

+ "Microsoft.Network/virtualNetworks/subnets/join/action",

+ "Microsoft.Network/virtualNetworks/usages/read",

+ "Microsoft.Network/virtualNetworks/read",

+ "Microsoft.Network/networkSecurityGroups/read",

+ "Microsoft.Marketplace/offerTypes/publishers/offers/plans/agreements/read",

+ "Microsoft.KeyVault/vaults/deploy/action",

+ "Microsoft.Storage/storageAccounts/read",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.DesktopVirtualization/scalingPlans/read",

+ "Microsoft.DesktopVirtualization/scalingPlans/write"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Desktop Virtualization Virtual Machine Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Windows 365 Network Interface Contributor

+This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces.

+[Learn more](/windows-365/enterprise/role-based-access)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/read | Gets or lists resource groups. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/locations/operations/read | Gets operation resource that represents status of an asynchronous operation |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/locations/operationResults/read | Gets operation result of an async POST or DELETE operation |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/locations/usages/read | Gets the resources usage metrics |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/write | Creates a network interface or updates an existing network interface. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/delete | Deletes a network interface |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/join/action | Joins a Virtual Machine to a network interface. Not Alertable. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/effectiveNetworkSecurityGroups/action | Get Network Security Groups configured On Network Interface Of The Vm |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/effectiveRouteTable/action | Get Route Table configured On Network Interface Of The Vm |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/1f135831-5bbe-4924-9016-264044c00788",

+ "name": "1f135831-5bbe-4924-9016-264044c00788",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Resources/subscriptions/resourcegroups/read",

+ "Microsoft.Resources/deployments/read",

+ "Microsoft.Resources/deployments/write",

+ "Microsoft.Resources/deployments/delete",

+ "Microsoft.Resources/deployments/operations/read",

+ "Microsoft.Resources/deployments/operationstatuses/read",

+ "Microsoft.Network/locations/operations/read",

+ "Microsoft.Network/locations/operationResults/read",

+ "Microsoft.Network/locations/usages/read",

+ "Microsoft.Network/networkInterfaces/write",

+ "Microsoft.Network/networkInterfaces/read",

+ "Microsoft.Network/networkInterfaces/delete",

+ "Microsoft.Network/networkInterfaces/join/action",

+ "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",

+ "Microsoft.Network/networkInterfaces/effectiveRouteTable/action"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Windows 365 Network Interface Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Windows 365 Network User

+This role is used by Windows 365 to read virtual networks and join the designated virtual networks.

+[Learn more](/windows-365/enterprise/role-based-access)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/usages/read | Get the IP usages for each subnet of the virtual network |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "This role is used by Windows 365 to read virtual networks and join the designated virtual networks.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/7eabc9a4-85f7-4f71-b8ab-75daaccc1033",

+ "name": "7eabc9a4-85f7-4f71-b8ab-75daaccc1033",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Network/virtualNetworks/read",

+ "Microsoft.Network/virtualNetworks/subnets/read",

+ "Microsoft.Network/virtualNetworks/usages/read",

+ "Microsoft.Network/virtualNetworks/subnets/join/action"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Windows 365 Network User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/VirtualMachines/Read | Read virtualmachines |

+> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/VirtualMachines/Extensions/Write | Write extension resource |

+> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/VirtualMachines/Extensions/Read | Gets extension resource |

+> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachines/WACloginAsAdmin/action | Lets you manage the OS of your resource via Windows Admin Center as an administrator. |

+## Connected Cluster Managed Identity CheckAccess Reader

+Built-in role that allows a Connected Cluster managed identity to call the checkAccess API

+[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Built-in role that allows a Connected Cluster managed identity to call the checkAccess API",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/65a14201-8f6c-4c28-bec4-12619c5a9aaa",

+ "name": "65a14201-8f6c-4c28-bec4-12619c5a9aaa",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Authorization/*/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Connected Cluster Managed Identity CheckAccess Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## PostgreSQL Flexible Server Long Term Retention Backup Role

+Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup.

+[Learn more](/azure/backup/backup-azure-database-postgresql-flex-overview)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/ltrBackupOperations/read | Returns the list of PostgreSQL server long term backup operation tracking. |

+> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/ltrPreBackup/action | Checks if a server is ready for a long term backup |

+> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/startLtrBackup/action | Start long term backup for a server |

+> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/locations/azureAsyncOperation/read | Return PostgreSQL Server Operation Results |

+> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/locations/operationResults/read | Return PostgreSQL Server Operation Results |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/c088a766-074b-43ba-90d4-1fb21feae531",

+ "name": "c088a766-074b-43ba-90d4-1fb21feae531",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupOperations/read",

+ "Microsoft.DBforPostgreSQL/flexibleServers/ltrPreBackup/action",

+ "Microsoft.DBforPostgreSQL/flexibleServers/startLtrBackup/action",

+ "Microsoft.DBforPostgreSQL/locations/azureAsyncOperation/read",

+ "Microsoft.DBforPostgreSQL/locations/operationResults/read",

+ "Microsoft.Resources/subscriptions/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "PostgreSQL Flexible Server Long Term Retention Backup Role",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Deployment Environments Reader

+Provides read access to environment resources.

+[Learn more](/azure/deployment-environments/how-to-configure-deployment-environments-user)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/read | Gets a specific project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/read | Gets a machine pool |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/schedules/read | Gets a schedule resource. |

+> | **DataActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminRead/action | Allows a project administrator to read all of the environments in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionRead/action | Allows an admin to read environment actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminOutputsRead/action | Allows an admin to read Output values from environment deployment. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides read access to environment resources.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/eb960402-bf75-4cc3-8d68-35b34f960f72",

+ "name": "eb960402-bf75-4cc3-8d68-35b34f960f72",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.DevCenter/projects/read",

+ "Microsoft.DevCenter/projects/*/read",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [

+ "Microsoft.DevCenter/projects/pools/read",

+ "Microsoft.DevCenter/projects/pools/schedules/read"

+ ],

+ "dataActions": [

+ "Microsoft.DevCenter/projects/users/environments/adminRead/action",

+ "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",

+ "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Deployment Environments Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Deployment Environments User

+Provides access to manage environment resources.

+[Learn more](/azure/deployment-environments/how-to-configure-deployment-environments-user)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/read | Gets a specific project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/*/read | |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | **NotActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/read | Gets a machine pool |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/pools/schedules/read | Gets a schedule resource. |

+> | **DataActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userRead/action | Allows a user to read the environments they have access to in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userWrite/action | Allows a user to write the environments they have access to in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userDelete/action | Allows a user to delete the environments they have access to in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userActionManage/action | Allows a user to skip, delay etc. environment actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userOutputsRead/action | Allows a user to read Output values from environment deployment. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides access to manage environment resources.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/18e40d4e-8d2e-438d-97e1-9528336e149c",

+ "name": "18e40d4e-8d2e-438d-97e1-9528336e149c",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.DevCenter/projects/read",

+ "Microsoft.DevCenter/projects/*/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.Authorization/*/read"

+ ],

+ "notActions": [

+ "Microsoft.DevCenter/projects/pools/read",

+ "Microsoft.DevCenter/projects/pools/schedules/read"

+ ],

+ "dataActions": [

+ "Microsoft.DevCenter/projects/users/environments/userRead/action",

+ "Microsoft.DevCenter/projects/users/environments/userWrite/action",

+ "Microsoft.DevCenter/projects/users/environments/userDelete/action",

+ "Microsoft.DevCenter/projects/users/environments/userActionManage/action",

+ "Microsoft.DevCenter/projects/users/environments/userOutputsRead/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Deployment Environments User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## DevCenter Dev Box User

+Provides access to create and manage dev boxes.

+[Learn more](/azure/dev-box/how-to-dev-box-user)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/read | Gets a specific project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStop/action | Allows a user to stop their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStart/action | Allows a user to start their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userGetRemoteConnection/action | Allows a user to get the RDP connection information for their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userRead/action | Allows a user to read their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userWrite/action | Allows a user to create and update their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userDelete/action | Allows a user to delete their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userUpcomingActionRead/action | Allows a user to read upcoming actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userUpcomingActionManage/action | Allows a user to skip or delay upcoming actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionRead/action | Allows a user to read dev box actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionManage/action | Allows a user to skip or delay dev box actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userCustomize/action | Allows a user to customize their own Dev Box resources. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides access to create and manage dev boxes.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/45d50f46-0b78-4001-a660-4198cbe8cd05",

+ "name": "45d50f46-0b78-4001-a660-4198cbe8cd05",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.DevCenter/projects/read",

+ "Microsoft.DevCenter/projects/*/read",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.DevCenter/projects/users/devboxes/userStop/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userStart/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userRead/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "DevCenter Dev Box User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## DevCenter Project Admin

+Provides access to manage project resources.

+[Learn more](/azure/dev-box/how-to-project-admin)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/* | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/write | Partially updates a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/delete | Deletes a project resource. |

+> | **DataActions** | |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminStart/action | Allows a user to start any Dev Box resource. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminStop/action | Allows a user to stop any Dev Box resource. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminRead/action | Allows a user read access to any Dev Box resource. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminWrite/action | Allows a user write access to any Dev Box resource. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/adminDelete/action | Allows a user to delete any Dev Box resource. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStop/action | Allows a user to stop their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userStart/action | Allows a user to start their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userGetRemoteConnection/action | Allows a user to get the RDP connection information for their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userRead/action | Allows a user to read their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userWrite/action | Allows a user to create and update their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userDelete/action | Allows a user to delete their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionRead/action | Allows a user to read dev box actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userActionManage/action | Allows a user to skip or delay dev box actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/devboxes/userCustomize/action | Allows a user to customize their own Dev Box resources. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminRead/action | Allows a project administrator to read all of the environments in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userWrite/action | Allows a user to write the environments they have access to in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminWrite/action | Allows a project administrator to write all of the environments in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/userDelete/action | Allows a user to delete the environments they have access to in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminDelete/action | Allows a project administrator to delete all of the environments in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminAction/action | Allows a project administrator to perform an action on all of the environments in a project. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionRead/action | Allows an admin to read environment actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminActionManage/action | Allows an admin to skip, delay etc. environment actions. |

+> | [Microsoft.DevCenter](../permissions/devops.md#microsoftdevcenter)/projects/users/environments/adminOutputsRead/action | Allows an admin to read Output values from environment deployment. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Provides access to manage project resources.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/331c37c6-af14-46d9-b9f4-e1909e1b95a0",

+ "name": "331c37c6-af14-46d9-b9f4-e1909e1b95a0",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.DevCenter/projects/*",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [

+ "Microsoft.DevCenter/projects/write",

+ "Microsoft.DevCenter/projects/delete"

+ ],

+ "dataActions": [

+ "Microsoft.DevCenter/projects/users/devboxes/adminStart/action",

+ "Microsoft.DevCenter/projects/users/devboxes/adminStop/action",

+ "Microsoft.DevCenter/projects/users/devboxes/adminRead/action",

+ "Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",

+ "Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userStop/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userStart/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userRead/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",

+ "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action",

+ "Microsoft.DevCenter/projects/users/environments/adminRead/action",

+ "Microsoft.DevCenter/projects/users/environments/userWrite/action",

+ "Microsoft.DevCenter/projects/users/environments/adminWrite/action",

+ "Microsoft.DevCenter/projects/users/environments/userDelete/action",

+ "Microsoft.DevCenter/projects/users/environments/adminDelete/action",

+ "Microsoft.DevCenter/projects/users/environments/adminAction/action",

+ "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",

+ "Microsoft.DevCenter/projects/users/environments/adminActionManage/action",

+ "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "DevCenter Project Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Hybrid Server Resource Administrator

+Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider.

+[Learn more](/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-identity-and-access-management)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/* | |

+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/*/read | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/48b40c6e-82e0-4eb3-90d5-19e40f49b624",

+ "name": "48b40c6e-82e0-4eb3-90d5-19e40f49b624",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.HybridCompute/machines/*",

+ "Microsoft.HybridCompute/*/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Hybrid Server Resource Administrator",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## API Management Developer Portal Content Editor

+Can customize the developer portal, edit its content, and publish it.

+[Learn more](/azure/api-management/api-management-role-based-access-control)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/portalRevisions/read | Lists a collection of developer portal revision entities. or Gets developer portal revision specified by its identifier. |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/portalRevisions/write | Creates a new developer portal revision. or Updates the description of specified portal revision or makes it current. |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/read | Returns list of content types or Returns content type |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/delete | Removes content type. |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/write | Creates new content type |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/contentItems/read | Returns list of content items or Returns content item details |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/contentItems/write | Creates new content item or Updates specified content item |

+> | [Microsoft.ApiManagement](../permissions/integration.md#microsoftapimanagement)/service/contentTypes/contentItems/delete | Removes specified content item. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Can customize the developer portal, edit its content, and publish it.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/c031e6a8-4391-4de0-8d69-4706a7ed3729",

+ "name": "c031e6a8-4391-4de0-8d69-4706a7ed3729",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.ApiManagement/service/portalRevisions/read",

+ "Microsoft.ApiManagement/service/portalRevisions/write",

+ "Microsoft.ApiManagement/service/contentTypes/read",

+ "Microsoft.ApiManagement/service/contentTypes/delete",

+ "Microsoft.ApiManagement/service/contentTypes/write",

+ "Microsoft.ApiManagement/service/contentTypes/contentItems/read",

+ "Microsoft.ApiManagement/service/contentTypes/contentItems/write",

+ "Microsoft.ApiManagement/service/contentTypes/contentItems/delete"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "API Management Developer Portal Content Editor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## App Configuration Contributor

+Grants permission for all management operations, except purge, for App Configuration resources.

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/* | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/locations/deletedConfigurationStores/purge/action | Purge the specified deleted configuration store. |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Grants permission for all management operations, except purge, for App Configuration resources.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/fe86443c-f201-4fc4-9d2a-ac61149fbda0",

+ "name": "fe86443c-f201-4fc4-9d2a-ac61149fbda0",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.AppConfiguration/*",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [

+ "Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"

+ ],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "App Configuration Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## App Configuration Reader

+Grants permission for read operations for App Configuration resources.

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.AppConfiguration](../permissions/integration.md#microsoftappconfiguration)/*/read | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/read | Read a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Grants permission for read operations for App Configuration resources.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/175b81b9-6e0d-490a-85e4-0d422273c10c",

+ "name": "175b81b9-6e0d-490a-85e4-0d422273c10c",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.AppConfiguration/*/read",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Insights/alertRules/read",

+ "Microsoft.Resources/deployments/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "App Configuration Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Azure Resource Notifications System Topics Subscriber

+Lets you create system topics and event subscriptions on all system topics exposed currently and in the future by Azure Resource Notifications

+[Learn more](/azure/event-grid/event-schema-resource-notifications)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.ResourceNotifications](../permissions/integration.md#microsoftresourcenotifications)/systemTopics/subscribeToResources/action | Permission to perform creation and event subscription creation on a Resources system topic |

+> | [Microsoft.ResourceNotifications](../permissions/integration.md#microsoftresourcenotifications)/systemTopics/subscribeToHealthResources/action | Permission to perform creation and event subscription creation on a HealthResources system topic |

+> | [Microsoft.ResourceNotifications](../permissions/integration.md#microsoftresourcenotifications)/systemTopics/subscribeToMaintenanceResources/action | Permission to perform creation and event subscription creation on a MaintenanceResources system topic |

+> | [Microsoft.ResourceNotifications](../permissions/integration.md#microsoftresourcenotifications)/systemTopics/subscribeToComputeResources/action | Permission to perform creation and event subscription creation on a ComputeResources system topic |

+> | [Microsoft.ResourceNotifications](../permissions/integration.md#microsoftresourcenotifications)/systemTopics/subscribeToComputeScheduleResources/action | Permission to perform creation and event subscription creation on a ComputeScheduleResources system topic |

+> | [Microsoft.EventGrid](../permissions/integration.md#microsofteventgrid)/eventSubscriptions/write | Create or update an eventSubscription |

+> | [Microsoft.EventGrid](../permissions/integration.md#microsofteventgrid)/systemTopics/eventSubscriptions/write | Create or update a SystemTopic eventSubscription |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Lets you create system topics and event subscriptions on all system topics exposed currently and in the future by Azure Resource Notifications",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/0b962ed2-6d56-471c-bd5f-3477d83a7ba4",

+ "name": "0b962ed2-6d56-471c-bd5f-3477d83a7ba4",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action",

+ "Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action",

+ "Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action",

+ "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action",

+ "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action",

+ "Microsoft.EventGrid/eventSubscriptions/write",

+ "Microsoft.EventGrid/systemTopics/eventSubscriptions/write"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Azure Resource Notifications System Topics Subscriber",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Chamber Admin

+Lets you manage everything under your Modeling and Simulation Workbench chamber.

+[Learn more](/azure/modeling-simulation-workbench/how-to-guide-manage-users)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/*/read | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/* | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/fileRequests/manage/action | manage fileRequests |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/connector/setCopyPaste/action | |

+> | **DataActions** | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/upload/action | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/files/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Lets you manage everything under your Modeling and Simulation Workbench chamber.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/4e9b8407-af2e-495b-ae54-bb60a55b1b5a",

+ "name": "4e9b8407-af2e-495b-ae54-bb60a55b1b5a",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.ModSimWorkbench/*/read",

+ "Microsoft.ModSimWorkbench/workbenches/chambers/*",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [

+ "Microsoft.ModSimWorkbench/workbenches/chambers/fileRequests/manage/action",

+ "Microsoft.ModSimWorkbench/workbenches/chambers/connector/setCopyPaste/action"

+ ],

+ "dataActions": [

+ "Microsoft.ModSimWorkbench/workbenches/chambers/upload/action",

+ "Microsoft.ModSimWorkbench/workbenches/chambers/files/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Chamber Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Chamber User

+Lets you view everything under your Modeling and Simulation Workbench chamber, but not make any changes.

+[Learn more](/azure/modeling-simulation-workbench/how-to-guide-manage-users)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/*/read | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/workloads/* | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/getUploadUri/action | getUploadUri chambers |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/fileRequests/getDownloadUri/action | getDownloadUri fileRequests |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.ModSimWorkbench](../permissions/integration.md#microsoftmodsimworkbench)/workbenches/chambers/upload/action | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Lets you view everything under your Modeling and Simulation Workbench chamber, but not make any changes.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/4447db05-44ed-4da3-ae60-6cbece780e32",

+ "name": "4447db05-44ed-4da3-ae60-6cbece780e32",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.ModSimWorkbench/workbenches/chambers/*/read",

+ "Microsoft.ModSimWorkbench/workbenches/chambers/workloads/*",

+ "Microsoft.ModSimWorkbench/workbenches/chambers/getUploadUri/action",

+ "Microsoft.ModSimWorkbench/workbenches/chambers/fileRequests/getDownloadUri/action",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.ModSimWorkbench/workbenches/chambers/upload/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Chamber User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## DICOM Data Owner

+Full access to DICOM data.

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/workspaces/dicomservices/resources/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Full access to DICOM data.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/58a3b984-7adf-4c20-983a-32417c86fbc8",

+ "name": "58a3b984-7adf-4c20-983a-32417c86fbc8",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthcareApis/workspaces/dicomservices/resources/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "DICOM Data Owner",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## DICOM Data Reader

+Read and search DICOM data.

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/workspaces/dicomservices/resources/read | Read DICOM resources (includes searching and change feed). |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Read and search DICOM data.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a",

+ "name": "e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthcareApis/workspaces/dicomservices/resources/read"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "DICOM Data Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## EventGrid TopicSpaces Publisher

+Lets you publish messages on topicspaces.

+[Learn more](/azure/event-grid/mqtt-client-microsoft-entra-token-and-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.EventGrid](../permissions/integration.md#microsofteventgrid)/*/read | |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.EventGrid](../permissions/integration.md#microsofteventgrid)/topicSpaces/publish/action | Publish to a topic space |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Lets you publish messages on topicspaces.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/a12b0b94-b317-4dcd-84a8-502ce99884c6",

+ "name": "a12b0b94-b317-4dcd-84a8-502ce99884c6",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Authorization/*/read",

+ "Microsoft.EventGrid/*/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.EventGrid/topicSpaces/publish/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "EventGrid TopicSpaces Publisher",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## EventGrid TopicSpaces Subscriber

+Lets you subscribe messages on topicspaces.

+[Learn more](/azure/event-grid/mqtt-client-microsoft-entra-token-and-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.EventGrid](../permissions/integration.md#microsofteventgrid)/*/read | |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.EventGrid](../permissions/integration.md#microsofteventgrid)/topicSpaces/subscribe/action | Subscribe to a topic space |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Lets you subscribe messages on topicspaces.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/4b0f2fd7-60b4-4eca-896f-4435034f8bf5",

+ "name": "4b0f2fd7-60b4-4eca-896f-4435034f8bf5",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Authorization/*/read",

+ "Microsoft.EventGrid/*/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.EventGrid/topicSpaces/subscribe/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "EventGrid TopicSpaces Subscriber",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+## FHIR Data Converter

+Role allows user or principal to convert data from legacy format to FHIR

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/services/fhir/resources/convertData/action | Data convert operation ($convert-data) |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/workspaces/fhirservices/resources/convertData/action | Data convert operation ($convert-data) |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Role allows user or principal to convert data from legacy format to FHIR",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/a1705bd2-3a8f-45a5-8683-466fcfd5cc24",

+ "name": "a1705bd2-3a8f-45a5-8683-466fcfd5cc24",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",

+ "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "FHIR Data Converter",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+[Learn more](/azure/healthcare-apis/fhir/import-data)

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+## FHIR SMART User

+Role allows user to access FHIR Service according to SMART on FHIR specification

+[Learn more](/azure/healthcare-apis/configure-azure-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/services/fhir/resources/read | Read FHIR resources (includes searching and versioned history). |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/workspaces/fhirservices/resources/read | Read FHIR resources (includes searching and versioned history). |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/services/fhir/resources/smart/action | Allows user to access FHIR Service according to SMART on FHIR specification. |

+> | [Microsoft.HealthcareApis](../permissions/integration.md#microsofthealthcareapis)/workspaces/fhirservices/resources/smart/action | Allows user to access FHIR Service according to SMART on FHIR specification. |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Role allows user to access FHIR Service according to SMART on FHIR specification",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/4ba50f17-9666-485c-a643-ff00808643f0",

+ "name": "4ba50f17-9666-485c-a643-ff00808643f0",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.HealthcareApis/services/fhir/resources/read",

+ "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",

+ "Microsoft.HealthcareApis/services/fhir/resources/smart/action",

+ "Microsoft.HealthcareApis/workspaces/fhirservices/resources/smart/action"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "FHIR SMART User",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Device Provisioning Service Data Contributor

+Allows for full access to Device Provisioning Service data-plane operations.

+[Learn more](/azure/iot-dps/concepts-control-access-dps-azure-ad)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.Devices](../permissions/internet-of-things.md#microsoftdevices)/provisioningServices/* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Allows for full access to Device Provisioning Service data-plane operations.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/dfce44e4-17b7-4bd1-a6d1-04996ec95633",

+ "name": "dfce44e4-17b7-4bd1-a6d1-04996ec95633",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.Devices/provisioningServices/*"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Device Provisioning Service Data Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Device Provisioning Service Data Reader

+Allows for full read access to Device Provisioning Service data-plane properties.

+[Learn more](/azure/iot-dps/concepts-control-access-dps-azure-ad)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | *none* | |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.Devices](../permissions/internet-of-things.md#microsoftdevices)/provisioningServices/*/read | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Allows for full read access to Device Provisioning Service data-plane properties.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/10745317-c249-44a1-a5ce-3a4353c0bbd8",

+ "name": "10745317-c249-44a1-a5ce-3a4353c0bbd8",

+ "permissions": [

+ {

+ "actions": [],

+ "notActions": [],

+ "dataActions": [

+ "Microsoft.Devices/provisioningServices/*/read"

+ ],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Device Provisioning Service Data Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Firmware Analysis Admin

+Upload and analyze firmware images in Defender for IoT

+[Learn more](/azure/defender-for-iot/device-builders/defender-iot-firmware-analysis-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.IoTFirmwareDefense](../permissions/internet-of-things.md#microsoftiotfirmwaredefense)/* | |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "Upload and analyze firmware images in Defender for IoT",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/9c1607d1-791d-4c68-885d-c7b7aaff7c8a",

+ "name": "9c1607d1-791d-4c68-885d-c7b7aaff7c8a",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.IoTFirmwareDefense/*",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Resources/subscriptions/resourceGroups/read",

+ "Microsoft.Resources/deployments/*"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Firmware Analysis Admin",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Advisor Recommendations Contributor (Assessments and Reviews)

+View assessment recommendations, accepted review recommendations, and manage the recommendations lifecycle (mark recommendations as completed, postponed or dismissed, in progress, or not started).

+[Learn more](/azure/advisor/permissions)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/recommendations/read | Reads recommendations |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/recommendations/write | Writes recommendations |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/recommendations/available/action | New recommendation is available in Microsoft Advisor |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "View assessment recommendations, accepted review recommendations, and manage the recommendations lifecycle (mark recommendations as completed, postponed or dismissed, in progress, or not started).",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/6b534d80-e337-47c4-864f-140f5c7f593d",

+ "name": "6b534d80-e337-47c4-864f-140f5c7f593d",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Advisor/recommendations/read",

+ "Microsoft.Advisor/recommendations/write",

+ "Microsoft.Advisor/recommendations/available/action"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Advisor Recommendations Contributor (Assessments and Reviews)",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Advisor Reviews Contributor

+View reviews for a workload and triage recommendations linked to them.

+[Learn more](/azure/advisor/permissions)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/resiliencyReviews/read | Read resiliencyReviews |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/triageRecommendations/read | Read triageRecommendations |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/triageRecommendations/approve/action | Approve triageRecommendations |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/triageRecommendations/reject/action | Reject triageRecommendations |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/triageRecommendations/reset/action | Reset triageRecommendations |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "View reviews for a workload and triage recommendations linked to them.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/8aac15f0-d885-4138-8afa-bfb5872f7d13",

+ "name": "8aac15f0-d885-4138-8afa-bfb5872f7d13",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Advisor/resiliencyReviews/read",

+ "Microsoft.Advisor/triageRecommendations/read",

+ "Microsoft.Advisor/triageRecommendations/approve/action",

+ "Microsoft.Advisor/triageRecommendations/reject/action",

+ "Microsoft.Advisor/triageRecommendations/reset/action",

+ "Microsoft.Authorization/*/read",

+ "Microsoft.Insights/alertRules/*",

+ "Microsoft.Resources/deployments/*",

+ "Microsoft.Resources/subscriptions/resourceGroups/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Advisor Reviews Contributor",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Advisor Reviews Reader

+View reviews for a workload and recommendations linked to them.

+[Learn more](/azure/advisor/permissions)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/resiliencyReviews/read | Read resiliencyReviews |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/triageRecommendations/read | Read triageRecommendations |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | *none* | |

+> | **NotDataActions** | |

+> | *none* | |

+```json

+{

+ "assignableScopes": [

+ "/"

+ ],

+ "description": "View reviews for a workload and recommendations linked to them.",

+ "id": "/providers/Microsoft.Authorization/roleDefinitions/c64499e0-74c3-47ad-921c-13865957895c",

+ "name": "c64499e0-74c3-47ad-921c-13865957895c",

+ "permissions": [

+ {

+ "actions": [

+ "Microsoft.Advisor/resiliencyReviews/read",

+ "Microsoft.Advisor/triageRecommendations/read"

+ ],

+ "notActions": [],

+ "dataActions": [],

+ "notDataActions": []

+ }

+ ],

+ "roleName": "Advisor Reviews Reader",

+ "roleType": "BuiltInRole",

+ "type": "Microsoft.Authorization/roleDefinitions"

+}

+```

+## Azure Center for SAP solutions administrator

+This role provides read and write access to all capabilities of Azure Center for SAP solutions.

+[Learn more](/azure/sap/center-sap-solutions/manage-with-azure-rbac)

+> [!div class="mx-tableFixed"]

+> | Actions | Description |

+> | | |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/configurations/read | Get configurations |

+> | [Microsoft.Advisor](../permissions/management-and-governance.md#microsoftadvisor)/recommendations/read | Reads recommendations |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/sapvirtualInstances/*/read | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/sapVirtualInstances/*/write | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/sapVirtualInstances/*/delete | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/Locations/*/action | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/Locations/*/read | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/sapVirtualInstances/*/start/action | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/sapVirtualInstances/*/stop/action | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/connectors/*/read | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/connectors/*/write | |

+> | [Microsoft.Workloads](../permissions/management-and-governance.md#microsoftworkloads)/connectors/*/delete | |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metrics/read | Read metrics |

+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/metricDefinitions/read | Read metric definitions |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |

+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read | Gets available metrics for the PingMesh |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/virtualMachines/read | Gets references to all the virtual machines in a virtual network subnet |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/ipconfigurations/read | Gets a network interface ip configuration definition. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/loadBalancers/read | Gets all the load balancers that the network interface is part of |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read | Gets available metrics for the Network Interface |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/read | Gets a load balancer definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/backendAddressPools/read | Gets a load balancer backend address pool definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/frontendIPConfigurations/read | Gets a load balancer frontend IP configuration definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/loadBalancingRules/read | Gets a load balancer load balancing rule definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/inboundNatRules/read | Gets a load balancer inbound nat rule definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/providers/Microsoft.Insights/logDefinitions/read | Gets the events for Load Balancer |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/networkInterfaces/read | Gets references to all the network interfaces under a load balancer |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/outboundRules/read | Gets a load balancer outbound rule definition |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/virtualMachines/read | Gets references to all the virtual machines under a load balancer |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read | Gets the available metrics for Load Balancer |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/read | Gets an private endpoint resource. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |

+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/join/action | Joins a route table. Not Alertable. |

+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/read | Returns the list of storage accounts or gets the properties for the specified storage account. |

+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/blobServices/read | Returns blob service properties or statistics |

+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/blobServices/containers/read | Returns list of containers |

+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/read | Get file service properties |

+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/fileServices/shares/read | List file shares |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/read | Get the properties of an availability set |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/sshPublicKeys/read | Get the properties of an SSH public key |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/sshPublicKeys/write | Creates a new SSH public key or updates an existing SSH public key |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/sshPublicKeys/*/generateKeyPair/action | |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/extensions/read | Get the properties of a virtual machine extension |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/extensions/delete | Deletes the virtual machine extension |

+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/read | Get the properties of a Disk |

+> | **NotActions** | |

+> | *none* | |

+> | **DataActions** | |

+> | [Microsoft.Storage](../permiss