azureazure-functionsazure-rbac

Assigning permissions to a custom role in Azure

So I'm creating a custom role.. let's call it "MyCompanyDeveloperRole"

I go onto the function app in the portal logged in as someone with that role.

It won't render the function apps list on the overview page as you can see.

I click on the link "See details" (highlighted in yellow), it then proceeds to say "... not have authorization to perform action 'Microsoft.Web/sites/host/properties/read'..."

Function App Overview Page

Then you go in and edit the role adding custom role json editor in the portal which then says... no such role!

Error in custom role JSON editor

Working out what permissions to give is a nightmare!!!

Another example.... when visiting the role assignments for a managed identity that belongs to an Azure app service... the current role assignments aren't showing up... I have no idea what role is missing? I've tried a bunch already!

Solution

  • As mentioned in MSDOC, Microsoft.web/sites/host/properties/read action is not available.

    List of actions available under Microsoft.web/sites/host:

    enter image description here

    Follow below steps:

    1. Create a custom role and assign below permissions/actions:
    Microsoft.Web/sites/config/list/Action
Microsoft.Web/sites/Read

    enter image description here

    1. Grant the custom role access to the user.

    enter image description here

    1. Able to access the function App and create the functions.

    enter image description here