Update API Management Service Operator role description - #128689
Update API Management Service Operator role description#128689Maciej Treder (maciejtreder) wants to merge 1 commit into
Conversation
Clarified the API Management Service Operator role's permissions and implications regarding service restoration.
|
Maciej Treder (@maciejtreder) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. Robert Lyon (@rolyon) |
1 similar comment
|
Maciej Treder (@maciejtreder) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. Robert Lyon (@rolyon) |
|
Learn Build status updates of commit 3d7125d: ✅ Validation status: passed
For more details, please refer to the build report. |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Clarifies the permissions and real-world impact of the API Management Service Operator Role, specifically highlighting that restore-from-backup can effectively modify service entities even without direct write permissions.
Changes:
- Expanded the role description to explain that
Microsoft.ApiManagement/service/restore/actioncan indirectly create/modify/replace APIs and related entities. - Added guidance to restrict assignment of this role to principals trusted with full configuration write impact.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ## API Management Service Operator Role | ||
|
|
||
| Can manage service but not the APIs | ||
| Can manage service but not the APIs. Although this role does not grant write permissions on individual service entities (APIs, policies, products, etc.), the Microsoft.ApiManagement/service/restore/action permission allows a full service restore from a backup, which can create, modify, or replace those entities as a side effect. Grant this role only to principals you'd also trust with write access to all service configuration. |
|
Precious Mwongera (@mwongerapk) Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
Clarified the API Management Service Operator role's permissions and implications regarding service restoration.