To deploy the using the ARM template, Azure permissions are required as described in this article. You may require input from your organization’s cloud administrator for access and permissions.The following list summarizes the permissions required:
Resource Group
Contributor or Owner role to create and manage resource groups.
Virtual Network
Network Contributor role to create and manage virtual networks and subnets.
Key Vault
Key Vault Contributor role to create key vaults.
Key Vault Secrets User role for the ‘s managed identity to list and get secret values.
Key Vault Administrator or Key Vault Secrets Officer role for other users to list and edit key vault secrets if the ARM template creates the key vault.
Managed Identity
Managed Identity Contributor role to create and manage managed identities.
Container App
Container App Contributor role to deploy and manage container apps.
Log Analytics Workspace
Log Analytics Contributor role to create and manage log analytics workspaces.
General Permissions
Contributor or Owner role on the subscription to manage overall resources and permissions.
The ARM template creates or edits multiple different resources, and the user will need roles capable of deploying these specific resources, as well as the correct role to deploy an ARM template. These resources are:
Resource name
Type
Virtual Network
Microsoft.Network/virtualNetworks
Virtual Network Subnet
Microsoft.Network/virtualNetworks/subnets
Container App Environment
Microsoft.App/managedEnvironments
Key Vault
Microsoft.KeyVault/vaults
Managed Identity
Microsoft.ManagedIdentity/userAssignedIdentities
Role Assignment
Microsoft.Authorization/roleAssignments
Log Analytics Workspace
Microsoft.OperationalInsights/workspaces
Container App
Microsoft.App/containerApps
To create the necessary resources, you will need the following permissions:
Creates a virtual network or updates an existing virtual network.
Microsoft.Network/virtualNetworks/peer/action
Peers a virtual network with another virtual network.
Microsoft.KeyVault/vaults/read
Gets the properties of a key vault.
Microsoft.KeyVault/vaults/write
Creates a new key vault or updates the properties of an existing key vault. Certain properties may require more permissions.
For enhanced security, you can manually create a new managed identity and assign custom roles with only the desired permissions as a prerequisite step. Then, use that managed identity with the template to create one or more s in the desired resource group.
These are the fine-grained permissions that are required for using the ARM template. These could be added to a custom role that is then conferred to a user to allow them to deploy the template.For more information, read Azure permissions in the Azure documentation.
There is an Azure built-in role that will enable the user to deploy the template. This has a wider level of access than is required by the template, so you may prefer to create your own custom role with the fine-grained permissions described above. For more information, read Azure built-in role in the Azure documentation.
Name
ID
Description
Contributor
b24988ac-6180-42a0-ab88-20f7382dd24c
Grants full access to manage all resources, but doesn’t allow you to assign roles in Azure RBAC (Role Based Access control), manage assignments in Azure Blueprints, or share image galleries.
