Enhance role-definitions.md with control plane examples - #128683
Enhance role-definitions.md with control plane examples#128683Rafael Fernández (rfernandezdo) wants to merge 1 commit into
Conversation
Added examples and explanations for control plane permissions, highlighting the interaction between Actions and NotActions.
|
Rafael Fernández (@rfernandezdo) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. Robert Lyon (@rolyon) |
1 similar comment
|
Rafael Fernández (@rfernandezdo) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. Robert Lyon (@rolyon) |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Enhances the RBAC role definitions documentation by adding more control-plane examples to clarify how Actions and NotActions combine, especially when they overlap.
Changes:
- Added a new table with overlapping
Actions/NotActionsexamples and their effective permissions. - Added explanatory bullets describing precedence/overlap behavior.
- Extended the NOTE with guidance about validating
Actions/NotActionsentries.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| > | `*`</br>`Microsoft.Network/virtualNetworks/subnets/join/action` | `Microsoft.Network/*` | All control plane permissions except `Microsoft.Network/*`</br>`Microsoft.Network/virtualNetworks/subnets/join/action` is excluded | | ||
| > | `Microsoft.Authorization/*/read` | `Microsoft.Authorization/*/read` | *none* | |
| > [!div class="mx-tableFixed"] | ||
| > | Actions | NotActions | Effective control plane permissions | | ||
| > | --- | --- | --- | | ||
| > | `*`</br>`Microsoft.Network/virtualNetworks/subnets/join/action` | `Microsoft.Network/*` | All control plane permissions except `Microsoft.Network/*`</br>`Microsoft.Network/virtualNetworks/subnets/join/action` is excluded | |
| > [!NOTE] | ||
| > If a user is assigned a role that excludes an action in `NotActions`, and is assigned a second role that grants access to the same action, the user is allowed to perform that action. `NotActions` is not a deny rule – it is simply a convenient way to create a set of allowed actions when specific actions need to be excluded. | ||
| > | ||
| > Also note that `NotActions` only excludes actions that match valid Azure resource provider operations. If an entry in `NotActions` does not correspond to a valid operation pattern, it does not exclude anything in practice. For this reason, both `Actions` and `NotActions` should be validated against the current Azure resource provider operations catalog. |
|
Learn Build status updates of commit ecff47a: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Can you review the proposed changes? Important: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
Added examples and explanations for control plane permissions, highlighting the interaction between Actions and NotActions.