Configuring permissions on Microsoft Azure Stack Hub

Before NetBackup Snapshot Manager can protect your Microsoft Azure Stack assets, it must have access to them. You must associate a custom role that NetBackup Snapshot Manager users can use to work with Azure Stack assets.

The following is a custom role definition (in JSON format) that gives NetBackup Snapshot Manager the ability to:

Configure Azure Stack Hub plug-in and discover assets.
Create host and disk snapshots.
Restore snapshots to the original location or to a new location.
Delete snapshots.

Table: NetBackup Snapshot Manager feature versus permissions for Microsoft Azure Stack Hub cloud provider

Feature	Task/Operation	Required permission
VM based
Backup from snapshot	To create shared access signature URI for backup from snapshot.	*Microsoft.Storage//read**
	To generate shared access signature URI for backup from snapshot.	Microsoft.Compute/restorePointCollections/restorePoints/retrieveSasUris/action
	To get access to read from disk restore point for creating backup copy in backup from snapshot.	Microsoft.Compute/restorePointCollections/restorePoints/diskRestorePoints/beginGetAccess/action
	To obtain end access to restore points, after successful backup from snapshot.	Microsoft.Compute/restorePointCollections/restorePoints/diskRestorePoints/endGetAccess/action
Creating backup from snapshot	To get access to the snapshot data.	Microsoft.Compute/snapshots/beginGetAccess/action
Creating backup from snapshot	For ending the URI after data from snapshot copied into the backup.	Microsoft.Compute/snapshots/endGetAccess/action
Restore from backup from snapshot	To create shared access signature URI for the managed disk.	Microsoft.Compute/disks/beginGetAccess/action
Restore from backup from snapshot	To delete shared access signature URI, after backup from snapshot.	Microsoft.Compute/disks/endGetAccess/action
Protection of Virtual Machines	To list VMs, VM scale set and attached disks.	*Microsoft.Compute//read**
Protection of SQL databases	To list Azure SQL databases to be protected.	*Microsoft.Sql//read**
Restore disks from snapshots/restore points	To create disk for restore.	Microsoft.Compute/disks/write
Rollback restore/ Cleanup in restore	To restore VM in rollback restore. Or To cleanup in case of failure in restore workflow.	Microsoft.Compute/virtualMachines/delete
Restore disk	To identify the available disk attachment points, for restoring disks/ files.	Microsoft.Compute/virtualMachines/vmSizes/read
Cleanup	To delete public IP, in case of cleanup in restore workflow failure. When the original VM has public IP and the alternate location restore fails.	Microsoft.Network/publicIPAddresses/delete
Cleanup	To delete RPC, if create snapshot workflow fails, and therefore rollback.	Microsoft.Compute/restorePointCollections/delete
List Resources (Discovery)	To get resource group and location information.	*Microsoft.Resources//read**
Discovery	To list subscriptions which can be used to list out the assets to be protected.	*Microsoft.Subscription//read**
Snapshots and Restores	To add tags to snapshots for indicating that the tags are created by Snapshot Manager To add tags which are originally present in the VM to the restored VM.	Microsoft.Resources/subscriptions/tagNames/tagValues/write Microsoft.Resources/subscriptions/tagNames/write
Snapshot	To protect disk snapshots from accidental deletion.	Microsoft.Authorization/locks/*
List restore points	To list snapshots (restore point), for restores.	Microsoft.Compute/restorePointCollections/read
List snapshots	To list and map restore point for the VMs.	Microsoft.Compute/restorePointCollections/restorePoints/read
List disk snapshots	To list disk restore points, for application consistency.	Microsoft.Compute/restorePointCollections/restorePoints/diskRestorePoints/read
Write snapshots	For incremental snapshots as restore points (Application consistent).	Microsoft.Compute/restorePointCollections/restorePoints/write
Snapshot cleanup	For cleanup in case of restore failures.	Microsoft.Compute/restorePointCollections/restorePoints/delete
Create restore point collections	To create RPC, 1 per VM in case a snapshot is triggered for the VM.	Microsoft.Compute/restorePointCollections/write
Restore VM	For creating VM in restore.	Microsoft.Compute/virtualMachines/write
	For power on restored VM, as mentioned in protection plan.	Microsoft.Compute/virtualMachines/start/action
	To change the state of VM. Stopping the VM for rollback restore.	Microsoft.Compute/virtualMachines/powerOff/action
	To list the networks for restores into the same network as original resource, or to a network selected by user.	*Microsoft.Network//read**
	To rollback restore, cleanup in case of failure in workflow.	Microsoft.Network/networkInterfaces/delete
	To attach network interface card to restored VM.	Microsoft.Network/networkInterfaces/join/action
	To create network interface card for VM restore.	Microsoft.Network/networkInterfaces/write
	To attach network security group to VM during restore.	Microsoft.Network/networkSecurityGroups/join/action
	To create network security group for VM restore, if original VM has one.	Microsoft.Network/networkSecurityGroups/write
	To attach public IP, in restore when original VM has public IP.	Microsoft.Network/publicIPAddresses/join/action
	To create public IP, in restore when original VM has public IP.	Microsoft.Network/publicIPAddresses/write
	To create VM in a subnet, that is, join a subnet.	Microsoft.Network/virtualNetworks/subnets/join/action
Kubernetes cluster based
Get cluster information	To obtain the cluster information.	Microsoft.ContainerService/managedClusters/agentPools/read
Scale-in/Scale-out	To obtain the capability of the cluster.	Microsoft.ContainerService/managedClusters/read
Scale-in	To maintain the state of VM scale set.	Microsoft.Compute/virtualMachineScaleSets/delete/action
Scale-out	To maintain the state of VM scale set.	Microsoft.Compute/virtualMachineScaleSets/write
Marketplace deployment
High availability	To attach Snapshot Manager data disk to VM scale set instance.	Microsoft.Compute/virtualMachineScaleSets/write
High availability	(Scale-in) To maintain the state of the VM scale set.	Microsoft.Compute/virtualMachineScaleSets/delete/action

To create a custom role using Powershell, follow the steps mentioned in the Azure Stack documentation.

For example:

New-AzRoleDefinition

New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json"

New-AzureRmRoleDefinition

New-AzureRmRoleDefinition -InputFile C:\tools\customRoleDef.json

To create a custom role using Azure CLI, follow the steps mentioned in the Azure documentation.

For example:

az role definition create --role-definition "~/CustomRoles/
registrationrole.json"

Note:

Before creating a role, you must copy the role definition (text in JSON format) in a .json file and then use that file as the input file. In the sample command displayed earlier, registrationrole.json is used as the input file that contains the role definition text.

To use this role, perform the following:

Assign the role to an application running in the Azure Stack environment.
In NetBackup Snapshot Manager, configure the Azure Stack off-host plug-in with the application's credentials.

More Information

Microsoft Azure Stack Hub plug-in configuration notes

Configuring permissions on Microsoft Azure Stack Hub

Feedback

Feedback