Add Microsoft.Authorization/roleAssignments/read (#497)

* New-AzPolicyReaderRole script creates roleAssignments/read permission * Updated policy reader role screenshots Updated policy reader role documentation --------- Co-authored-by: Benjamin Rohner <[email protected]>
Azure · Mar 6, 2024 · 154ad5f · 154ad5f
1 parent 06e01cd
commit 154ad5f
Show file tree

Hide file tree

Showing 5 changed files with 3 additions and 0 deletions.
diff --git a/Docs/Images/ci-cd-role-policy-reader-3.png b/Docs/Images/ci-cd-role-policy-reader-3.png
diff --git a/Docs/Images/ci-cd-role-policy-reader-4.png b/Docs/Images/ci-cd-role-policy-reader-4.png
diff --git a/Docs/ci-cd-app-registrations.md b/Docs/ci-cd-app-registrations.md
@@ -25,6 +25,7 @@ EPAC uses a set of Entra ID App Registrations (Service Principals). To build the
                     "Microsoft.Authorization/policydefinitions/read",
                     "Microsoft.Authorization/policyexemptions/read",
                     "Microsoft.Authorization/policysetdefinitions/read",
+                    "Microsoft.Authorization/roleAssignments/read",
                     "Microsoft.PolicyInsights/*",
                     "Microsoft.Management/register/action",
                     "Microsoft.Management/managementGroups/read"

diff --git a/Docs/create-policy-reader-role.md b/Docs/create-policy-reader-role.md
@@ -6,6 +6,7 @@ Creates a custom role `EPAC Resource Policy Reader` with `Id` `2baa1a7c-6807-46a
 * `Microsoft.Authorization/policydefinitions/read`
 * `Microsoft.Authorization/policyexemptions/read`
 * `Microsoft.Authorization/policysetdefinitions/read`
+* `Microsoft.Authorization/roleAssignments/read`
 * `Microsoft.PolicyInsights/*`
 * `Microsoft.Management/register/action`
 * `Microsoft.Management/managementGroups/read`

diff --git a/Scripts/Operations/New-AzPolicyReaderRole.ps1 b/Scripts/Operations/New-AzPolicyReaderRole.ps1
@@ -69,6 +69,7 @@ $perms = @(
     "Microsoft.Authorization/policydefinitions/read",
     "Microsoft.Authorization/policyexemptions/read",
     "Microsoft.Authorization/policysetdefinitions/read",
+    "Microsoft.Authorization/roleAssignments/read",
     "Microsoft.PolicyInsights/*",
     "Microsoft.Management/register/action",
     "Microsoft.Management/managementGroups/read"