When publishing an Azure Managed Application, many ISVs choose to make some functionality available to the owner of the application. You know which of the Azure built-in roles you want to use, but you aren’t sure what actions to include. That built-in roles page also includes the list you need for Allowed control actions and Allowed data actions. Everything under Actions for the role goes into Allowed control actions. Anything under DataActions for the role goes into Allowed data actions. You just need to add the list as a semi-colon delimited list and you are good to go.
If you don’t want to read the docs and you know exactly what you want, you can also pull this information through the az cli or Azure PowerShell. To list all roles, run:
Az cli: az role definition list
PowerShell: Get-AzRoleDefinition
If you already know which role you need details on, you can run another command to get just the specifics for that role. For example, let’s say I know I need the Reader and Data Access role from Storage. I can run:
Az cli: az role definition list --name 'Reader and Data Access'
PowerShell: Get-AzRoleDefinition -Name 'Reader and Data access'
Once you have the specific role, you can then emit the right values for the control actions and data actions. This is fairly easy to do in PowerShell.
$roleDefinition = Get-AzRoleDefinition -Name 'Reader and Data access'
Write-Host "Control actions:" ($roleDefinition.Actions -join ";")
Write-Host "Data actions:" ($roleDefinition.DataActions -join ";")
Karmic Code Monkey 