Adding a Microsoft Azure Stack custom role to provide access permissions to NetBackup administrator
NetBackup requires access to Azure Stack subscriptions to protect them. You must create a custom user in Active Directory for NetBackup and grant the user the role to access the subscriptions. You can either give a co-owner role to the user or you can create a custom role with permissions that are required for backup and recovery. An Azure Stack administrator as a subscription owner can create the custom role for a subscription.
The minimum permissions that NetBackup requires are as follows:
Microsoft.Compute/virtualMachines/*
Microsoft.Network/networkInterfaces/*
Microsoft.Network/networkSecurityGroups/join/action
Microsoft.Network/networkSecurityGroups/read
Microsoft.Network/publicIPAddresses/join/action
Microsoft.Network/publicIPAddresses/read
Microsoft.Network/publicIPAddresses/write
Microsoft.Network/virtualNetworks/read
Microsoft.Network/virtualNetworks/subnets/read
Microsoft.Network/virtualNetworks/subnets/join/action
Microsoft.Resources/subscriptions/resourceGroups/read
Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/listKeys/action
To create a custom role, complete the following steps:
- Complete the following steps on a Windows computer that has PowerShell for Azure Stack.
For Active Directory Federation Services (ADFS)
Create a user or service principal named
nbu_azstin the Active Directory from the Active Directory Users and Computers dialog box from Microsoft Management Console.For Microsoft Azure Active Directory (Azure AD)
Create the service principal from the Microsoft Azure Active Directory Users dialog box.
For more information, refer to https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-powershell-install.
- Create a new text file
rbac_NBU_role.jsonand add the following script in the file:{ "Name": "NBU BnR Role", "IsCustom": true, "Description": "Let's you perform backup and recovery of VMs", "Actions": [ "Microsoft.Compute/virtualMachines/*", "Microsoft.Compute/Disks/read", "Microsoft.Compute/Disks/write", "Microsoft.Compute/Disks/beginGetAccess/action", "Microsoft.Compute/Disks/endGetAccess/action", "Microsoft.Compute/Snapshots/*", "Microsoft.Network/networkInterfaces/*", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/publicIPAddresses/join/action", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/publicIPAddresses/write", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualNetworks/subnets/read", "Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Resources/Resources/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/listKeys/action" ], "NotActions": [], "AssignableScopes": [ "/subscriptions/subscription_ID_1", "/subscriptions/subscription_ID_2" . . . ] }Note:
Ensure that you add the required subscriptions under the AssignableScopes field so that the custom role is created with those subscriptions.
For example, in the file snippet, replace subscription_ID_1 and subscription_ID_2 with actual subscription IDs that you have.
- Run the following commands:
Add-AzureRMEnvironment -Name AzureStackAdmin -ArmEndpoint "ArmEndpointValue"
For example, Add-AzureRMEnvironment -Name AzureStackAdmin -ArmEndpoint "https://management.local.azurestack.external"
Add-AzureRmAccount -EnvironmentName "AzureStackAdmin"
New-AzureRmRoleDefinition -InputFile "<directory_path>\rbac_NBU_role.json"
You can use the following ARM endpoints:
provider subscription
tenant subscription
- Open the Microsoft Azure Stack console and complete the following steps:
1. Click Menu and open the subscriptions that you want to protect with NetBackup. Click Access Control (IAM) > Roles to view the newly created role.
2. From Subscriptions > Access Control (IAM), click Add. In the Select Name field add
nbu_azstuser (ADFS) or the display name of the service principal (AAD), in the Type field select User, and in the Role field select the newly added role. - Add the
nbu_azstuser or service principal to the tpconfig command to take backups.
More Information