Edit

Roles and permissions

Learn how to manage access to recommendations and reviews for your organization.

Roles and associated access

Advisor uses the built-in roles provided by Azure role-based access control (Azure RBAC).

Review the following section to learn more about each role and the associated access.

Roles to manage recommendations status

Role View recommendations Manage recommendation status
Advisor Recommendations Contributor (Assessments and Reviews) X X
Subscription Reader X
Subscription Contributor X X
Subscription Owner X X
Resource group Reader X
Resource group Contributor X X
Resource group Owner X X
Resource Reader X
Resource Contributor X X
Resource Owner X X

Roles to manage access to Advisor personalized or review recommendations

Role View reviews View review recommendations Manage recommendation statuses
Advisor Reviews Reader/Advisor Reviews Contributor X
Advisor Recommendations Contributor (Assessments and Reviews) X X
Subscription Reader X X
Subscription Contributor X X X
Subscription Owner X X X
Resource Reader X X
Resource Contributor X X X
Resource Owner X X X

Roles to edit rules and configurations

Role Edit rules Edit subscription configuration Edit resource group configuration
Subscription Contributor X X X
Subscription Owner X X X
Resource group Contributor X
Resource group Owner X

Note

You must have access to the resource associated with the recommendation to view a recommendation.

To learn more about built-in roles, see Azure built-in roles. To learn more about Azure role-based access control (Azure RBAC), see What is Azure role-based access control (Azure RBAC)?.

Reviews and personalized recommendations

Roles to manage access to Advisor reviews

The permissions vary by role. The roles must be configured for the subscription that was used to publish the review.

Role View reviews for a workload and all recommendations associated with the reviews Triage recommendations associated with the reviews
Advisor Reviews Reader ✅
Advisor Reviews Contributor ✅ ✅
Subscription Reader ✅
Subscription Contributor ✅ ✅
Subscription Owner ✅ ✅

Roles to manage access to Advisor personalized recommendations

The roles must be configured for the subscriptions included in the workload under a review.

Role View accepted recommendations Manage the lifecycle of a recommendation
Advisor Recommendations Contributor (Assessments and Reviews) ✅ ✅
Subscription Reader ✅
Subscription Contributor ✅ ✅
Subscription Owner ✅ ✅
Resource Reader ✅
Resource Contributor ✅ ✅
Resource Owner ✅ ✅

Learn how to assign an Azure role, see Steps to assign an Azure role.

View and manage assessments

Roles to view and manage assessments and associated recommendations

Manage access to Advisor Well-Architected Framework (WAF) using built-in roles. The permissions vary by role.

Role Detail
Reader View assessments for a subscription or workload and the associated recommendations.
Contributor Create assessments for a subscription or workload and manage lifecycle of the associated recommendations.

Note

The role must be configured for the relevant subscription to create the assessment and view the corresponding recommendations.

Available actions to build custom roles

If your organization requires roles that don't match the Azure built-in roles, create your own custom role. A custom role works like a built-in role and you can assign it to users, groups, and service principals at management group, subscription, and resource group scopes. Use the following actions to create your custom role.

Action Details
Microsoft.Advisor/recommendations/available/action Displays vailable action
Microsoft./generateRecommendations/action Create a Recommendation
Microsoft./register/action Register with the Provider
Microsoft./unregister/action Unregister with the Provider
Microsoft./Score/read Gets Advisor score
Microsoft./configurations/read Read Configurations.
Microsoft.Advisor/configurations/write Create or update Configuration
Microsoft.Advisor/generateRecommendations/read Get status of generateRecommendations action
Microsoft.Advisor/metadata/read Read Metadata
Microsoft.Advisor/operations/read Get operations
Microsoft.Advisor/recommendations/read Read recommendations
Microsoft.Advisor/recommendations/write Create recommendations.
Microsoft.Advisor/recommendations/available/action New recommendation is available.
Microsoft.Advisor/recommendations/suppressions/read Read Suppressions
Microsoft.Advisor/recommendations/suppressions/write Create or update Suppressions
Microsoft.Advisor/recommendations/suppressions/delete Delete Suppression
Microsoft.Advisor/suppressions/read Read Suppressions
Microsoft.Advisor/suppressions/write Create or update Suppressions
Microsoft.Advisor/suppressions/delete Delete Suppression
Microsoft.Advisor/assessmentTypes/read Reads AssessmentTypes
Microsoft.Advisor/assessments/read Reads Assessments
Microsoft.Advisor/assessments/write Create Assessments
Microsoft.Advisor/resiliencyReviews/read Reads resiliencyReviews
Microsoft.Advisor/triageRecommendations/read Reads triageRecommendations
Microsoft.Advisor/triageRecommendations/approve/action Approves triageRecommendations
Microsoft.Advisor/triageRecommendations/reject/action Rejects triageRecommendations
Microsoft.Advisor/triageRecommendations/reset/action Resets triageRecommendations
Microsoft.Advisor/workloads/read Reads workloads

Note

For example, you must have a sufficient permission level for a virtual machine (VM) to view recommendations associated with the VM.

To learn more about custom roles, see Azure custom roles.

Permissions and unavailable actions

If your permission level is too low, your access to the associated action is blocked. Review common problems in the following section.

Configure subscription or resource group is blocked

When you try to configure a subscription or resource group, the option to include or exclude is blocked. The blocked status indicates that your permission level for that resource group or subscription is insufficient. To learn how to change your permission level, see Tutorial: Grant a user access to Azure resources using the Azure portal.

Postpone or dismiss is allowed, but sends an error

When you try to postpone or dismiss a recommendation, you receive an error. The error indicates that your permission level is insufficient. You must have a sufficient permission level to dismiss recommendations.

Tip

After you dismiss a recommendation, you must manually reactivate it before it is added in your list of recommendations. If you dismiss a recommendation, you may miss important advice that optimizes your Azure deployment.

To postpone or dismiss a recommendation, verify that your permission level for the resource associated with the recommendation is set to Contributor or better. To learn how to change your permission level, see Tutorial: Grant a user access to Azure resources using the Azure portal.

Related content

This article provided an overview of how Advisor uses Azure role-based access control (Azure RBAC) to control user permissions and how to resolve common problems. To learn more about Advisor, see the following articles.

  • Last updated on