Permissions

This module now uses a single provider - AzAPI. See provider configuration for more information.

The identity used must have permission to:

• Create subscriptions using the Microsoft.Subscription/aliases resource. See the documentation for details.

Note: The following process explains how to assign EA roles to SPNs.

• Manage the subscription’s management group using the Microsoft.Management/managementGroups resource. For a detailed explanation of the permissions required, see the documentation.

Note: the identity that creates the subscription will have Owner permissions assigned by default. If you instead supply an existing subscription id, you must ensure that the identity of the provider has the Owner permissions assigned.

This sub-module manages the following resources using the AzAPI provider:

• Microsoft.Network/virtualHubs/hubVirtualNetworkConnections
• Microsoft.Network/virtualNetworks/virtualNetworkPeerings
• Microsoft.Network/virtualNetworks
• Microsoft.Resources/resourceGroups

These resources are deployed into the new or the supplied subscription. The identity of the AzAPI provider must have permission to create these resources.

The identity assigned to the AzAPI provider must also have the following permissions on hub networks to create virtual network peerings. We recommend that you create a custom role in order to maintain the least privilege principle.

See the documentation for more information.

The identity assigned to the AzAPI provider must also have the following permissions on hub networks to create virtual network connections. We recommend that you create a custom role in order to maintain the least privilege principle.

TBC

This sub-module manages role assignment resources using the AzAPI provider.

The role assignments are deployed into either the new or the supplied subscription, at subscription or child scopes. The identity of the provider must have permission to create these resources, typically this means having the Owner or User Access Administrator roles.