CODEWITHSUNDEEP
azureazure-active-directoryrbac
CSakura
CSakura

Reputation: 566

Azure Authorization: what is scope parameter in REST API?

I am creating a Azure custom role for blob storage access.

I started with Azure cli, and when I convert the json file to Terraform file, there is an extra parameter, scope.

It appears that it is the scope parameter in Azure REST API, controls where the role is defined (subscription, tenant or deeper).

Is it correct?

Upvotes: 2

Views: 1987

Answers (1)

Gaurav Mantri
Gaurav Mantri

Reputation: 136126

That's correct. Value for your scope parameter would depend on the level at which the role is defined. It could be one of the following values:

  • subscriptions/{subscriptionId}: Custom role is scoped at a subscription level.

  • subscriptions/{subscriptionId1}/resourceGroups/{resourceGroup1}: Custom role is scoped at a resource group level.

  • subscriptions/{subscriptionId1}/resourceGroups/{resourceGroup1}/providers/Microsoft.Web/sites/{site1}: Custom role is scoped at a resource level.

  • providers/Microsoft.Management/managementGroups/{groupId1}: Custom role is scoped at a management group level.

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-rest#list-custom-roles-at-a-scope

Upvotes: 1

Related Questions