To create a custom role, complete the following steps:

1. For Active Directory Federation Services (ADFS)	Create a user or service principal named nbu_azst in the Active Directory from the Active Directory Users and Computers dialog box from Microsoft Management Console.
   For Microsoft Azure Active Directory (Azure AD)	Create the service principal from the Microsoft Azure Active Directory Users dialog box.

   Complete the following steps on a Windows computer that has PowerShell for Azure Stack.

   For more information, refer to https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-powershell-install.

2. Create a new text file rbac_NBU_role.json and add the following script in the file:

   {
   "Name": "NBU BnR Role",
   "IsCustom": true,
   "Description": "Let's you perform backup and recovery of VMs",
   "Actions": [
   "Microsoft.Compute/virtualMachines/*",
   "Microsoft.Network/networkInterfaces/*",
   "Microsoft.Network/networkSecurityGroups/join/action",
   "Microsoft.Network/networkSecurityGroups/read",
   "Microsoft.Network/publicIPAddresses/join/action",
   "Microsoft.Network/publicIPAddresses/read",
   "Microsoft.Network/publicIPAddresses/write",
   "Microsoft.Network/virtualNetworks/read",
   "Microsoft.Network/virtualNetworks/subnets/read",
   "Microsoft.Network/virtualNetworks/subnets/join/action",
   "Microsoft.Resources/subscriptions/resourceGroups/read",
   "Microsoft.Storage/storageAccounts/read",
   "Microsoft.Storage/storageAccounts/listKeys/action"
   ],
   "NotActions": [],
   "AssignableScopes": [
   "/subscriptions/{subscription_ID_1}"
   "/subscriptions/{subscription_ID_2}"
   .
   .
   ]
   }

   Note:

   Ensure that you add the required subscriptions under the AssignableScopes field so that the custom role is created with those subscriptions.

   For example, in the file snippet, replace subscription_ID_1 and subscription_ID_2 with actual subscription IDs that you have.

3. Run the following commands:

   • Add-AzureRMEnvironment -Name AzureStackAdmin -ArmEndpoint "ArmEndpointValue"

     For example, Add-AzureRMEnvironment -Name AzureStackAdmin -ArmEndpoint "https://management.local.azurestack.external"

   • Add-AzureRmAccount -EnvironmentName "AzureStackAdmin"

   • New-AzureRmRoleDefinition -InputFile "<directory_path>\rbac_NBU_role.json"

   You can use the following ARM endpoints:

   • provider subscription

   • tenant subscription

4. Open the Microsoft Azure Stack console and complete the following steps:

   1. Click Menu and open the subscriptions that you want to protect with NetBackup. Click Access Control (IAM) > Roles to view the newly created role.

   2. From Subscriptions > Access Control (IAM), click Add. In the Select Name field add nbu_azst user (ADFS) or the display name of the service principal (AAD), in the Type field select User, and in the Role field select the newly added role.

5. Add the nbu_azst user or service principal to the tpconfig command to take backups.