azure-resources/azure-automation-account/rjAutomationAccountPermissions.json
|
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "languageVersion": "2.0", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.43.8.12551", "templateHash": "6332427662939012988" } }, "parameters": { "principalId": { "type": "string", "metadata": { "description": "The principal ID of the managed identity to assign permissions to" } } }, "variables": { "$fxv#0": [ { "Name": "Microsoft Graph", "Id": "00000003-0000-0000-c000-000000000000", "AppRoleAssignments": [ "AppCatalog.ReadWrite.All", "Application.ReadWrite.All", "AuditLog.Read.All", "BitlockerKey.Read.All", "Channel.Delete.All", "ChannelMember.ReadWrite.All", "ChannelSettings.ReadWrite.All", "CloudPC.ReadWrite.All", "Device.Read.All", "DeviceLocalCredential.Read.All", "DeviceManagementApps.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.PrivilegedOperations.All", "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All", "Directory.ReadWrite.All", "Group.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "InformationProtectionPolicy.Read.All", "Mail.Send", "Organization.Read.All", "Place.Read.All", "Policy.Read.All", "Reports.Read.All", "RoleManagement.Read.All", "Team.Create", "TeamSettings.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "WindowsUpdates.ReadWrite.All" ] }, { "Name": "Office 365 Exchange Online", "Id": "00000002-0000-0ff1-ce00-000000000000", "AppRoleAssignments": [ "Exchange.ManageAsApp" ] }, { "Name": "Windows Defender ATP / Security Center", "Id": "fc780465-2017-40d4-a0c5-307022471b92", "AppRoleAssignments": [ "Machine.Read.All", "Machine.Isolate", "Machine.RestrictExecution", "Ti.ReadWrite.All" ] }, { "Id": "00000003-0000-0ff1-ce00-000000000000", "Name": "Office 365 SharePoint Online", "AppRoleAssignments": [ "User.Read.All", "Sites.Read.All", "Sites.FullControl.All" ] } ], "permissionsConfig": "[variables('$fxv#0')]", "graphPermissions": "[filter(variables('permissionsConfig'), lambda('app', equals(lambdaVariables('app').Id, '00000003-0000-0000-c000-000000000000')))[0].AppRoleAssignments]", "exchangePermissions": "[filter(variables('permissionsConfig'), lambda('app', equals(lambdaVariables('app').Id, '00000002-0000-0ff1-ce00-000000000000')))[0].AppRoleAssignments]", "defenderPermissions": "[filter(variables('permissionsConfig'), lambda('app', equals(lambdaVariables('app').Id, 'fc780465-2017-40d4-a0c5-307022471b92')))[0].AppRoleAssignments]", "sharePointPermissions": "[filter(variables('permissionsConfig'), lambda('app', equals(lambdaVariables('app').Id, '00000003-0000-0ff1-ce00-000000000000')))[0].AppRoleAssignments]" }, "imports": { "microsoftGraphV1": { "provider": "MicrosoftGraph", "version": "1.0.0" } }, "resources": { "microsoftGraph": { "existing": true, "import": "microsoftGraphV1", "type": "Microsoft.Graph/servicePrincipals@v1.0", "properties": { "appId": "00000003-0000-0000-c000-000000000000" } }, "exchangeOnline": { "existing": true, "import": "microsoftGraphV1", "type": "Microsoft.Graph/servicePrincipals@v1.0", "properties": { "appId": "00000002-0000-0ff1-ce00-000000000000" } }, "defenderAtp": { "existing": true, "import": "microsoftGraphV1", "type": "Microsoft.Graph/servicePrincipals@v1.0", "properties": { "appId": "fc780465-2017-40d4-a0c5-307022471b92" } }, "sharePointOnline": { "existing": true, "import": "microsoftGraphV1", "type": "Microsoft.Graph/servicePrincipals@v1.0", "properties": { "appId": "00000003-0000-0ff1-ce00-000000000000" } }, "graphAppRoleAssignments": { "copy": { "name": "graphAppRoleAssignments", "count": "[length(variables('graphPermissions'))]" }, "import": "microsoftGraphV1", "type": "Microsoft.Graph/appRoleAssignedTo@v1.0", "properties": { "appRoleId": "[first(filter(reference('microsoftGraph').appRoles, lambda('role', equals(lambdaVariables('role').value, variables('graphPermissions')[copyIndex()])))).id]", "principalId": "[parameters('principalId')]", "resourceId": "[reference('microsoftGraph').id]" }, "dependsOn": [ "microsoftGraph" ] }, "exchangeAppRoleAssignments": { "copy": { "name": "exchangeAppRoleAssignments", "count": "[length(variables('exchangePermissions'))]" }, "import": "microsoftGraphV1", "type": "Microsoft.Graph/appRoleAssignedTo@v1.0", "properties": { "appRoleId": "[first(filter(reference('exchangeOnline').appRoles, lambda('role', equals(lambdaVariables('role').value, variables('exchangePermissions')[copyIndex()])))).id]", "principalId": "[parameters('principalId')]", "resourceId": "[reference('exchangeOnline').id]" }, "dependsOn": [ "exchangeOnline" ] }, "defenderAppRoleAssignments": { "copy": { "name": "defenderAppRoleAssignments", "count": "[length(variables('defenderPermissions'))]" }, "import": "microsoftGraphV1", "type": "Microsoft.Graph/appRoleAssignedTo@v1.0", "properties": { "appRoleId": "[first(filter(reference('defenderAtp').appRoles, lambda('role', equals(lambdaVariables('role').value, variables('defenderPermissions')[copyIndex()])))).id]", "principalId": "[parameters('principalId')]", "resourceId": "[reference('defenderAtp').id]" }, "dependsOn": [ "defenderAtp" ] }, "sharePointAppRoleAssignments": { "copy": { "name": "sharePointAppRoleAssignments", "count": "[length(variables('sharePointPermissions'))]" }, "import": "microsoftGraphV1", "type": "Microsoft.Graph/appRoleAssignedTo@v1.0", "properties": { "appRoleId": "[first(filter(reference('sharePointOnline').appRoles, lambda('role', equals(lambdaVariables('role').value, variables('sharePointPermissions')[copyIndex()])))).id]", "principalId": "[parameters('principalId')]", "resourceId": "[reference('sharePointOnline').id]" }, "dependsOn": [ "sharePointOnline" ] } }, "outputs": { "graphPermissionsCount": { "type": "int", "metadata": { "description": "Number of Microsoft Graph permissions assigned" }, "value": "[length(variables('graphPermissions'))]" }, "exchangePermissionsCount": { "type": "int", "metadata": { "description": "Number of Exchange Online permissions assigned" }, "value": "[length(variables('exchangePermissions'))]" }, "defenderPermissionsCount": { "type": "int", "metadata": { "description": "Number of Defender ATP permissions assigned" }, "value": "[length(variables('defenderPermissions'))]" }, "sharePointPermissionsCount": { "type": "int", "metadata": { "description": "Number of SharePoint Online permissions assigned" }, "value": "[length(variables('sharePointPermissions'))]" } } } |