Skip to main content
Agent Type:
Streaming
Agent Platform:
Azure ✅
To deploy the using the ARM template, Azure permissions are required as described in this article. You may require input from your organization’s cloud administrator for access and permissions. The following list summarizes the permissions required:
  • Resource Group
    • Contributor or Owner role to create and manage resource groups.
  • Virtual Network
    • Network Contributor role to create and manage virtual networks and subnets.
  • Key Vault
    • Key Vault Contributor role to create key vaults.
    • Key Vault Secrets User role for the agent’s managed identity to list and get secret values.
    • Key Vault Administrator or Key Vault Secrets Officer role for other users to list and edit key vault secrets if the ARM template creates the key vault.
  • Managed Identity
    • Managed Identity Contributor role to create and manage managed identities.
  • Container App
    • Container App Contributor role to deploy and manage container apps.
  • Log Analytics Workspace
    • Log Analytics Contributor role to create and manage log analytics workspaces.
  • General Permissions
    • Contributor or Owner role on the subscription to manage overall resources and permissions.

​
Deploying resources

The ARM template creates or edits multiple different resources, and the user will need roles capable of deploying these specific resources, as well as the correct role to deploy an ARM template. These resources are:
Resource nameType
Virtual NetworkMicrosoft.Network/virtualNetworks
Virtual Network SubnetMicrosoft.Network/virtualNetworks/subnets
Container App EnvironmentMicrosoft.App/managedEnvironments
Key VaultMicrosoft.KeyVault/vaults
Managed IdentityMicrosoft.ManagedIdentity/userAssignedIdentities
Role AssignmentMicrosoft.Authorization/roleAssignments
Log Analytics WorkspaceMicrosoft.OperationalInsights/workspaces
Container AppMicrosoft.App/containerApps
To create the necessary resources, you will need the following permissions:
ActionDescription
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Resources/subscriptions/resourceGroups/writeCreates or updates a resource group.
Microsoft.Network/virtualNetworks/readGets the virtual network definition.
Microsoft.Network/virtualNetworks/writeCreates a virtual network or updates an existing virtual network.
Microsoft.Network/virtualNetworks/peer/actionPeers a virtual network with another virtual network.
Microsoft.KeyVault/vaults/readGets the properties of a key vault.
Microsoft.KeyVault/vaults/writeCreates a new key vault or updates the properties of an existing key vault. Certain properties may require more permissions.

​
Fine-grained permissions

These are the fine-grained permissions that are required for using the ARM template. These could be added to a custom role that is then conferred to a user to allow them to deploy the template. For more information, read Azure permissions in the Azure documentation.

​
Deployments (microsoft.resources/deployments)

ActionDescription
Microsoft.Resources/deployments/readGets or lists deployments.
Microsoft.Resources/deployments/writeCreates or updates a deployment.
Microsoft.Resources/deployments/deleteDeletes a deployment.
Microsoft.Resources/deployments/cancel/actionCancels a deployment.
Microsoft.Resources/deployments/validate/actionValidates a deployment.
Microsoft.Resources/deployments/whatIf/actionPredicts template deployment changes.
Microsoft.Resources/deployments/exportTemplate/actionExports the template for a deployment.
Microsoft.Resources/deployments/operations/readGets or lists deployment operations.
Microsoft.Resources/deployments/operationstatuses/readGets or lists deployment operation statuses.

​
Container app (microsoft.app/containerapps)

ActionDescription
microsoft.app/containerapps/writeCreates or updates a container app.
microsoft.app/containerapps/deleteDeletes a container app.
microsoft.app/containerapps/readGets a container app.
microsoft.app/containerapps/stop/actionStops a container app.
microsoft.app/containerapps/start/actionStarts a container app.
microsoft.app/containerapps/revisions/readGets a container app revision.
microsoft.app/containerapps/revisions/restart/actionRestarts a container app revision.
microsoft.app/containerapps/revisions/activate/actionActivates a container app revision.
microsoft.app/containerapps/revisions/deactivate/actionDeactivates a container app revision.
microsoft.app/containerapps/revisions/replicas/readGets a replica of a container app revision.

​
Managed environments (microsoft.app/managedenvironments)

ActionDescription
microsoft.app/managedenvironments/join/actionAllows the user to create a container app in a managed environment.
microsoft.app/managedenvironments/readGets a managed environment.
microsoft.app/managedenvironments/writeCreates or updates a managed environment.
microsoft.app/managedenvironments/checknameavailability/actionChecks resource name availability for a managed environment.

​
Virtual network (microsoft.networking/virtualnetworks)

ActionDescription
Microsoft.Network/virtualNetworks/readGets the virtual network definition.
Microsoft.Network/virtualNetworks/writeCreates a virtual network or updates an existing virtual network.
Microsoft.Network/virtualNetworks/peer/actionPeers a virtual network with another virtual network.

​
Key vault (microsoft.keyvault/vaults)

ActionDescription
Microsoft.KeyVault/vaults/readViews the properties of a key vault.
Microsoft.KeyVault/vaults/writeCreates a new key vault or updates the properties of an existing key vault. Certain properties may require more permissions.

​
Managed identity (Microsoft.ManagedIdentity/userAssignedIdentities)

ActionDescription
Microsoft.ManagedIdentity/userAssignedIdentities/assign/actionRBAC (Role Based Access Control) action for assigning an existing user assigned identity to a resource.
Microsoft.ManagedIdentity/userAssignedIdentities/readGets an existing user assigned identity.
Microsoft.ManagedIdentity/userAssignedIdentities/writeCreates a new user assigned identity or updates the tags associated with an existing user assigned identity.

​
Role assignments (Microsoft.Authorization/roleAssignments)

ActionDescription
Microsoft.Authorization/roleAssignments/readGets information about a role assignment.
Microsoft.Authorization/roleAssignments/writeCreates a role assignment at the specified scope.

​
Log analytics (Microsoft.OperationalInsights/workspaces)

ActionDescription
Microsoft.OperationalInsights/workspaces/writeCreates a new workspace or links to an existing workspace by providing the customer id from the existing workspace.
Microsoft.OperationalInsights/workspaces/readGets an existing workspace.
Microsoft.OperationalInsights/workspaces/listKeys/actionRetrieves the list keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.

​
Built-in roles

There is an Azure built-in role that will enable the user to deploy the template. This has a wider level of access than is required by the template, so you may prefer to create your own custom role with the fine-grained permissions described above. For more information, read Azure built-in role in the Azure documentation.
NameIDDescription
Contributorb24988ac-6180-42a0-ab88-20f7382dd24cGrants full access to manage all resources, but doesn’t allow you to assign roles in Azure RBAC (Role Based Access control), manage assignments in Azure Blueprints, or share image galleries.

​
Custom role example

This is an example of a custom role that could be created to reduce the scope of permissions required to deploy the template. 
{
    "id": "/subscriptions/d4538124-1936-43b3-87fb-f9ec5e395616/providers/Microsoft.Authorization/roleDefinitions/17098b84-72ad-4308-8d83-f16dca79ef56",
    "properties": {
        "roleName": "Documentation Test Role",
        "description": "Role to test for documentation purposes - to verify that we have all the correct permissions to deploy the ARM template",
        "assignableScopes": [
            "/subscriptions/d4538124-1936-43b3-87fb-f9ec5e395616/resourceGroups/jack-cha-demo"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Resources/deployments/*",
                    "microsoft.app/containerapps/write",
                    "microsoft.app/containerapps/delete",
                    "microsoft.app/containerapps/read",
                    "microsoft.app/containerapps/stop/action",
                    "microsoft.app/containerapps/start/action",
                    "microsoft.app/containerapps/revisions/read",
                    "microsoft.app/containerapps/revisions/restart/action",
                    "microsoft.app/containerapps/revisions/activate/action",
                    "microsoft.app/containerapps/revisions/deactivate/action",
                    "microsoft.app/containerapps/revisions/replicas/read",
                    "microsoft.app/managedenvironments/join/action",
                    "microsoft.app/managedenvironments/read",
                    "microsoft.app/managedenvironments/write",
                    "microsoft.app/managedenvironments/delete",
                    "microsoft.app/managedenvironments/checknameavailability/action",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/write",
                    "Microsoft.KeyVault/vaults/read",
                    "Microsoft.KeyVault/vaults/write",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/write",
                    "Microsoft.Authorization/roleAssignments/read",
                    "Microsoft.Authorization/roleAssignments/write",
                    "Microsoft.OperationalInsights/workspaces/write",
                    "Microsoft.OperationalInsights/workspaces/read",
                    "Microsoft.OperationalInsights/workspaces/listKeys/action"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}