AD Roles
Azure Event Hubs Data Owner
Allows for full access to Azure Event Hubs resources.
Azure Kubernetes Service RBAC Reader
Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.
Azure Kubernetes Service RBAC Writer
Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.
Azure Event Hubs Data Reciever
Allows receive access to Azure Event Hubs resources.
Azure Event Hubs Data Sender
Allows send access to Azure Event Hubs resources.
Managed Identity Contributor
Create, Read, Update, and Delete User Assigned Identity
Global Administrator
Full access to identity protection
Azure Kubernetes Service Contributor Role
Grants access to read and write Azure Kubernetes Service clusters
Contributor
Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.
Owner
Grants full access to manage all resources, including the ability to assign roles in Azure RBAC. in regards to acr - access resource manager, create/delete registry, push image, pull image, delete image data nd change policies
Authentication Administrator
Has access to view, set, and reset authentication method information for any non-admin
SQL Managed Instance Contributor
Lets you manage SQL Managed Instances and required network configuration, but can't give access to others.
SQL DB Contributor
Lets you manage SQL databases, but not access to them. Also, you can't manage their security-related policies or their parent SQL servers.
SQL Server Contributor
Lets you manage SQL servers and databases, but not access to them, and not their security-related policies.
Azure Kubernetes Service RBAC Cluster Admin
Lets you manage all resources in the cluster.
Azure Kubernetes Service RBAC Admin
Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.
Classic Virtual Machine Contributor
Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.
SQL Security Manager
Lets you manage the security-related policies of SQL servers and databases, but not access to them.
User Access Administrator
Lets you manage user access to Azure resources.
Virtual Machine Contributor
Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.
Security Assessment Contributor
Lets you push assessments to Security Center
Azure Kubernetes Service Cluster Admin Role
List cluster admin credential action.
Azure Kubernetes Service Cluster User Role
List cluster user credential action.
Key Vault Contributor
Manage key vaults, but does not allow you to assign roles in Azure RBAC, and does not allow you to access secrets, keys, or certificates.
Key Vault Administrator
Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets. Cannot manage key vault resources or manage role assignments. Only works for key vaults that use the 'Azure role-based access control' permission model.
Key Vault Certificates Officer
Perform any action on the certificates of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model.
Key Vault Secrets Officer
Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model.
AcrQuarantineReader
Quarantine reader
AcrQuarantineWriter
Quarantine writer
Managed Identity Operator
Read and Assign User Assigned Identity
Key Vault Reader
Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the 'Azure role-based access control' permission model.
Key Vault Secrets User
Read secret contents. Only works for key vaults that use the 'Azure role-based access control' permission model.
Virtual Machine User Login
View Virtual Machines in the portal and login as a regular user.
Virtual Machine Administrator Login
View Virtual Machines in the portal and login as administrator
Reader
View all resources, but does not allow you to make any changes. reader in regaurds to acr - access resource manager and pull image.
Security Admin
View and update permissions for Security Center. Same permissions as the Security Reader role and can also update the security policy and dismiss alerts and recommendations. full access to identity protection. cannot reset a password for a user.
Security Reader
View permissions for Security Center. Can view recommendations, alerts, a security policy, and security states, but cannot make changes. view all identity protection reports and overview blade. cannot configure or change polices, reset a password for a user or configure alerts, and give feedback on detections.
Application Administrator
can create and manage all aspects of app registrations and enterprise apps. Users in this role can create application registrations when the "Users can register applications" setting is set to No. This role also grants permission to consent on one's own behalf when the "Users can consent to apps accessing company data on their behalf" setting is set to No. Users assigned to this role are added as owners when creating new application registrations or enterprise applications.
Application Developer
can create application registrations independent of the users can register applications setting.
Azure Sentinel Contributor
create and edit workbooks, analytic rules and other azure sentinel resources. manage incidents, view data, incidents, workbooks, and other azure sentinel resources.
Azure Sentinel contributor + login app contributor
create and run playbooks, plus create and edit workbooks, analytic rules and other azure sentinel resources. manage incidents, view data, incidents, workbooks, and other azure sentinel resources.
AcrDelete
delete image data
Azure Sentinel Responder
manage incidents, view data, incidents, workbooks, and other azure sentinel resources.
AcrPull
pull image
AcrPush
push and pull image using docker push
AcrImageSigner
sign images. typically combined with push image to allow pushing a trusted image to a registry
Security Operator
view all identity protection reports and overview blade. dismiss user risk, confirm safe sign in, confirm compromise. cannot configure or change polices, reset a password for a user or configure alerts.
Azure Sentinel Reader
view data, incidents, workbooks, and other azure sentinel resources.