{ "id": "245498a1-3da3-4d16-a0ed-a5d8520d3197", "name": "Implement a Custom Role", "slug": "implement-a-custom-role", "status": "published", "lab_type": "azure", "is_sample": false, "duration_in_seconds": 1200, "metadata": {}, "session": null, "company": "a491bc32-c056-4946-9169-cc053387bada", "created": "2020-08-11T12:14:09.328293Z", "modified": "2023-10-03T18:58:31.996826Z", "is_beta": false, "lab_objectives": [], "main_learning_area": null, "learning_areas": [], "categories": [], "tags": [], "difficulty": null, "is_web_access": false, "is_lab_experience": false, "is_featured": false, "cve": null, "severity": null, "year": null, "classification": null, "is_trackable": false, "cpe_credits": null, "is_skill_check": false, "external_url": "https://portal.azure.com/", "solution_video": "45476762-25be-4c99-8e13-5d93f248efe2", "explanation_video": null, "description": "# Task: Implement a Custom Role\n\n## Video: Custom Roles\n\n**Estimated time:** 30 minutes\n\n## Goal\n\nThe goal of this task is to create a custom RBAC role and assign it to a test user on a resource group. The custom role will be a variation of the Contributor role that does not allow the deletion of any resources.\n\n## Pre-requisites\n\n1. Non-production Azure subscription\n2. An Azure AD cloud user named **tasks** for testing access\n\n## Requirements\n\n1. Requirement 1: Define a custom role\n1. Requirement 2: Assign the custom role\n1. Requirement 3: Test the custom role\n\n## Pre-requisite setup\n\nYou can create a new Azure AD user from the bash cloud shell by running the following command (substitute your values for the domain name and password):\n\n```bash\naz ad user create --display-name tasks --password --user-principal-name tasks@ --force-change-password-next-login false\n```\n\nExample\n\n```bash\naz ad user create --display-name tasks --password B@dPa55word! --user-principal-name tasks@inedemos.onmicrosoft.com --force-change-password-next-login false\n```\n\n## Requirement 1: Define a custom role\n\nTo complete this requirement, you must create a custom role named **Contributor-Limited** with the same permissions as the **Contributor** role, except without the ability to delete any resources. Take the following steps in a bash cloud shell to complete the requirement:\n\n- Open a bash cloud shell.\n- Save a copy of the JSON definition for the Contributor role in a file named **customRole.json**. *Hint - use the az role definition list CLI command.*\n- Open the customRole.json file for editing in Visual Studio Code from the bash cloud shell:\n\n```bash\ncode ./customRole.json\n```\n\n- Make the following changes to the file:\n - Set the assignable scopes to your subscription. The format is /subscriptions/<your subscription id>. *Hint: Use ```az account show``` to view your subscription id.**\n - If present, remove the outer brackets ([ ]).\n - Remove the **id**, **roleName**, **roleType**, and **type** attributes. Be sure to remove any commas that are no longer appropriate.\n - Change the name to **Contributor-Limited**.\n - Change the description to something meaningful.\n - Add a line to the **notActions** settings that disallows any deletions.\n- Save the file using Ctrl-S or Command-S. If this doesn't work, use the elipses in the top right corner to get the Visual Studio Code menu.\n- Close Visual Studio code using Ctrl-Q or Command-Q. If this doesn't work, use the elipses in the top right corner to get the Visual Studio Code menu.\n- Use the Azure CLI to create a new role definition based on the **customRole.json** file.\n\n## Requirement 2: Assign the custom role\n\nTo complete this requirement, you must provision a new resource group named **task-role-rg**. Assign the **Contributor-Limited** role to the **tasks** user on the **task-role-rg** resource group.\n\n## Requirement 3: Test the custom role\n\nTo complete this task you must log in to the Azure portal as the **tasks** user and verify the rights granted the user on the **task-role-rg** resource group. To complete this requirement:\n\n- Open an incognito/private browser window and log into the portal ([https://portal.azure.com](https://portal.azure.com)) as the **tasks** cloud user.\n- Add the following resources to the **task-role-rg** resource group:\n - A route table named **demo-rt**.\n- Attempt the following deletions from the resources:\n - A route table named **demo-rt**.\n\n## Cleanup\n\nWhen you have completed this task, delete the **task-role-rg** resource group and the **Contributor-Limited** role.", "description_html": "

Task: Implement a Custom Role

\n

Video: Custom Roles

\n

Estimated time: 30 minutes

\n

Goal

\n

The goal of this task is to create a custom RBAC role and assign it to a test user on a resource group. The custom role will be a variation of the Contributor role that does not allow the deletion of any resources.

\n

Pre-requisites

\n
    \n
  1. Non-production Azure subscription
    2. \n
  2. An Azure AD cloud user named tasks for testing access
    3. \n
\n

Requirements

\n
    \n
  1. Requirement 1: Define a custom role
    2. \n
  2. Requirement 2: Assign the custom role
    3. \n
  3. Requirement 3: Test the custom role
    4. \n
\n

Pre-requisite setup

\n

You can create a new Azure AD user from the bash cloud shell by running the following command (substitute your values for the domain name and password):

\n
az ad user create --display-name tasks --password <your password> --user-principal-name tasks@<your domain> --force-change-password-next-login false
\n\n

Example

\n
az ad user create --display-name tasks --password B@dPa55word! --user-principal-name tasks@inedemos.onmicrosoft.com --force-change-password-next-login false
\n\n

Requirement 1: Define a custom role

\n

To complete this requirement, you must create a custom role named Contributor-Limited with the same permissions as the Contributor role, except without the ability to delete any resources. Take the following steps in a bash cloud shell to complete the requirement:

\n\n
code ./customRole.json
\n\n\n

Requirement 2: Assign the custom role

\n

To complete this requirement, you must provision a new resource group named task-role-rg. Assign the Contributor-Limited role to the tasks user on the task-role-rg resource group.

\n

Requirement 3: Test the custom role

\n

To complete this task you must log in to the Azure portal as the tasks user and verify the rights granted the user on the task-role-rg resource group. To complete this requirement:

\n\n

Cleanup

\n

When you have completed this task, delete the task-role-rg resource group and the Contributor-Limited role.

", "tasks": "", "tasks_html": "", "published_date": "2020-04-07T18:00:00Z", "solutions": "", "solutions_html": "", "flags": [], "min_points_to_pass": null, "access_type": "default", "user_status": "unstarted", "user_lab_status": null, "user_status_modified": null, "user_flags": [] }