Arctera Application Mobility Service Help

Sample Role at Subscription level:

{
  "id": "/subscriptions/XXXX/providers/Microsoft.Authorization/
  roleDefinitions/XXXX",
  "properties": {
    "roleName": "ISAM-CUSTOM-RG-NEW-SUBS-LEVEL",
    "description": "Role at SUBSCRIPTION LEVEL",
    "assignableScopes": [
      "/subscriptions/XXXX"
    ],
    "permissions": [
      {
         "actions": [
           "Microsoft.MarketplaceOrdering/agreements/read",
           "Microsoft.MarketplaceOrdering/agreements/offers/
           plans/read",
           "Microsoft.MarketplaceOrdering/agreements/offers/
           plans/sign/action",
           "Microsoft.MarketplaceOrdering/agreements/offers/
           plans/cancel/action",
           "Microsoft.MarketplaceOrdering/offertypes/
           publishers/offers/plans/agreements/read",
           "Microsoft.MarketplaceOrdering/offertypes/
           publishers/offers/plans/agreements/write",
           "Microsoft.MarketplaceOrdering/operations/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": [],
      }
    ]
  }
}

Sample Role at Resource Group level:

{
  "id": "/subscriptions/XXXX/providers/Microsoft.Authorization/
  roleDefinitions/XXXX",
  "properties": {
    "roleName": "ISAM-CUSTOM-RG-AMS_ADMIN-WESTUS3",
    "description": "Role at RESOURCE GROUP LEVEL",
    "assignableScopes": [
      "/subscriptions/XXXX/AMS_ADMIN-WESTUS3"
    ],
    "permissions": [
      {
         "actions": [
           "Microsoft.Authorization/*/read",
           "Microsoft.Compute/locations/*",
           "Microsoft.Compute/virtualMachines/*",
           "Microsoft.Compute/disks/write",
           "Microsoft.Compute/disks/read",
           "Microsoft.Compute/disks/delete",
           "Microsoft.ResourceHealth/availabilityStatuses/read",
           "Microsoft.Resources/deployments/*",
           "Microsoft.SerialConsole/serialPorts/connect/action",
           "Microsoft.Storage/storageAccounts/listKeys/action",
           "Microsoft.Storage/storageAccounts/read",
           "Microsoft.Support/*",
           "Microsoft.Network/*",
           "Microsoft.Resources/subscriptions/resourceGroups/read",
           "Microsoft.Compute/images/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": [],
      }
    ]
  }
}

Once the roles are created, navigate to the Azure portal and locate the Managed Identity you want to enhance with these roles. You can find the Managed Identity in the Azure Active Directory section or within the Identity section of the corresponding Azure resource (e.g., Virtual Machine).

Add the custom roles created above to the Managed Identity. This ensures that the identity inherits the specified permissions.

Access the Azure portal and navigate to the Virtual Machine (VM) that serves as the gateway. Go to the VM's settings, specifically the "Identity" section.

Under "User assigned managed identities," add the Managed Identity configured above. This associates the identity with the VM, allowing it to inherit the roles and permissions assigned to the identity.