Search <book_title>...

NetBackup IT Analytics Data Collector Installation and Configuration Guide

Last Published: 2025-03-24

Product(s): NetBackup IT Analytics (11.6)

Platform: Complete,Protection,Storage

Create a principal and assign role to the application

This step enables the newly registered application to have access rights to the subscription.

To enable access rights to the subscription, you can either create a Contributor role or create a combination of Reader and Custom roles for the application. Since Reader and Custom roles have restricted permissions compared to the Contributor role, you can choose to assign them to the application if the privileges available through the Contributor role do not comply with your organizational policy.

To create a principal and assign a Contributor role:

Create a Principal for the Application:

New-AzureRmADServicePrincipal -ApplicationId <APPLICATIONID>

Create a Contributor role:

New-AzureRmRoleAssignment -RoleDefinitionName Contributor -ServicePrincipalName <APPLICATIONID>

To create a principal and assign Reader and Custom roles:

Create a Principal for the Application:

New-AzureRmADServicePrincipal -ApplicationId <APPLICATIONID>

Create a Reader role:

New-AzureRmRoleAssignment -RoleDefinitionName Reader 
-ServicePrincipalName <APPLICATIONID>

Assign a Reader role to the application:

New-AzureRmRoleAssignment -RoleDefinitionName Reader 
-ServicePrincipalName <APPLICATIONID>

Create a custom role with JSON template.

For example, create a file customrole.json using the following:

{ "Name": "<Role-Name>", "Id": null, "IsCustom": true, 
"Description": "<Role Description>", "Actions": 
[ "Microsoft.Storage/storageAccounts/listkeys/action" ], 
"NotActions": [], "DataActions": [], "NotDataActions": [], 
"AssignableScopes": [ "/subscriptions/<Subscription ID>" ] }

Create a Custom role:

New-AzRoleDefinition -InputFile "C:\CustomRoles\customrole.json"

Assign a custom role to application:

New-AzureRmRoleAssignment -RoleDefinitionName <customeRoleName> 
-ServicePrincipalName <APPLICATIONID>