Skip to content

Roles and permissions

Azure roles

The deploying user needs permission to create the managed application in the selected subscription and resource group. The application can also require role assignments for managed identities and supporting services.

Azure Contributor does not include permission to create every role assignment. Use the least-privilege role design approved by your Azure administrator rather than granting Owner by default.

Private Endpoint, VNet, private DNS, and DNS record changes may belong to different resource groups and teams. Assign only the resource-scoped roles needed for each task.

Managed resource group

Customer access can be limited by a deny assignment established by the managed application. Do not attempt to bypass it. Use supported managed actions or escalate.

Elasticsearch and Kibana

Separate:

  • security administration;
  • cluster monitoring;
  • index ingestion;
  • index read access;
  • Kibana content creation;
  • Kibana read-only access.

Reserve the built-in elastic superuser for tasks that require unrestricted access. Use named users, SSO mappings, or scoped API keys for routine work.

Microsoft describes managed application permission boundaries in Azure Managed Applications overview.