Veritas CloudPoint Administrator's Guide

Configuring permissions on Microsoft Azure

Before CloudPoint can protect your Microsoft Azure assets, it must have access to them. You must associate a custom role that CloudPoint users can use to work with Azure assets.

The following is a custom role definition (in JSON format) that gives CloudPoint the ability to:

{ "Name": "CloudPoint Admin", 
"IsCustom": true, 
"Description": "Necessary permissions for 
Azure plug-in operations in CloudPoint", 
"Actions": [
"Microsoft.Storage/*/read", 
"Microsoft.Compute/*/read", 
"Microsoft.Compute/disks/write", 
"Microsoft.Compute/disks/delete", 
"Microsoft.Compute/images/write", 
"Microsoft.Compute/images/delete", 
"Microsoft.Compute/snapshots/delete", 
"Microsoft.Compute/snapshots/write", 
"Microsoft.Compute/virtualMachines/capture/action", 
"Microsoft.Compute/virtualMachines/write", 
"Microsoft.Compute/virtualMachines/delete", 
"Microsoft.Compute/virtualMachines/generalize/action", 
"Microsoft.Compute/virtualMachines/restart/action", 
"Microsoft.Compute/virtualMachines/runCommand/action", 
"Microsoft.Compute/virtualMachines/start/action", 
"Microsoft.Compute/virtualMachines/vmSizes/read", 
"Microsoft.Network/*/read", 
"Microsoft.Network/networkInterfaces/delete", 
"Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action", 
"Microsoft.Network/networkInterfaces/join/action", 
"Microsoft.Network/networkInterfaces/write", 
"Microsoft.Network/networkSecurityGroups/join/action", 
"Microsoft.Network/networkSecurityGroups/securityRules/write", 
"Microsoft.Network/networkSecurityGroups/write", 
"Microsoft.Network/publicIPAddresses/delete", 
"Microsoft.Network/publicIPAddresses/join/action", 
"Microsoft.Network/publicIPAddresses/write", 
"Microsoft.Network/routeTables/join/action", 
"Microsoft.Network/virtualNetworks/delete", 
"Microsoft.Network/virtualNetworks/subnets/delete", 
"Microsoft.Network/virtualNetworks/subnets/join/action", 
"Microsoft.Network/virtualNetworks/write", 
"Microsoft.Resources/*/read", 
"Microsoft.Resources/subscriptions/resourceGroups/write", 
"Microsoft.Resources/subscriptions/resourceGroups/ \
validateMoveResources/action", 
"Microsoft.Resources/subscriptions/tagNames/tagValues/write", 
"Microsoft.Resources/subscriptions/tagNames/write", 
"Microsoft.Subscription/*/read", 
"Microsoft.Authorization/*/read" ], 
"NotActions": [ ], 
"AssignableScopes": [ 
"/subscriptions/subscription_GUID", 
"/subscriptions/subscription_GUID/ \
resourceGroups/myCloudPointGroup" ] }

To create a custom role using powershell, follow the steps in the following Azure documentation:

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

For example:

New-AzureRmRoleDefinition -InputFile "C:\CustomRoles\ReaderSupportRole.json"

To create a custom role using Azure CLI, follow the steps in the following Azure documentation:

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-cli

For example:

az role definition create --role-definition "~/CustomRoles/
ReaderSupportRole.json"

To use this role, do the following: