編輯

共用方式為

Set-AzRoleDefinition

  • Reference
Module:
Az.Resources

Modifies a custom role in Azure RBAC. Provide the modified role definition either as a JSON file or as a PSRoleDefinition. First, use the Get-AzRoleDefinition command to retrieve the custom role that you wish to modify. Then, modify the properties that you wish to change. Finally, save the role definition using this command.

Syntax

Set-AzRoleDefinition
   -InputFile <String>
   [-SkipClientSideScopeValidation]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]
Set-AzRoleDefinition
   -Role <PSRoleDefinition>
   [-SkipClientSideScopeValidation]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Description

The Set-AzRoleDefinition cmdlet updates an existing custom role in Azure Role-Based Access Control. Provide the updated role definition as an input to the command as a JSON file or a PSRoleDefinition object. The role definition for the updated custom role MUST contain the Id and all other required properties of the role even if they are not updated: DisplayName, Description, Actions, AssignableScopes. NotActions, DataActions, NotDataActions are optional.

Examples

Example 1: Update using PSRoleDefinitionObject

$roleDef = Get-AzRoleDefinition "Contoso On-Call"
$roleDef.Actions.Add("Microsoft.ClassicCompute/virtualmachines/start/action")
$roleDef.Description = "Can monitor all resources and start and restart virtual machines"
$roleDef.AssignableScopes = @("/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")
Set-AzRoleDefinition -Role $roleDef

Example 2: Create using JSON file

Set-AzRoleDefinition -InputFile C:\Temp\roleDefinition.json
<#
Following is a sample updated role definition json for Set-AzRoleDefinition:
{
        "Id": "52a6cc13-ff92-47a8-a39b-2a8205c3087e",
        "Name": "Updated Role",
        "Description": "Can monitor all resources and start and restart virtual machines",
        "Actions":
        [
            "*/read",
            "Microsoft.ClassicCompute/virtualmachines/restart/action",
            "Microsoft.ClassicCompute/virtualmachines/start/action"
        ],
        "NotActions":
        [
            "*/write"
        ],
        "DataActions":
        [
            "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
        ],
        "NotDataActions":
        [
            "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
        ],
        "AssignableScopes": ["/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]
}
#>

Parameters

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with azure

Type:IAzureContextContainer
Aliases:AzContext, AzureRmContext, AzureCredential
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-InputFile

File name containing a single json role definition to be updated. Only include the properties that are to be updated in the JSON. Id property is Required.

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-Role

Role definition object to be updated

Type:PSRoleDefinition
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-SkipClientSideScopeValidation

If specified, skip client side scope validation.

Type:SwitchParameter
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

Inputs

PSRoleDefinition

Outputs

PSRoleDefinition

Notes

Keywords: azure, azurerm, arm, resource, management, manager, resource, group, template, deployment