{
	"properties": {
		"roleName": "CVBackupRole",
		"IsCustom": "True",
		"description": "Custom role for protecting encrypted and unencrypted Azure VMs",
		"assignableScopes": [
			"/subscriptions/<<Your subscription ID>>"
		],
		"permissions": [
			{
				"actions": [
					"Microsoft.Compute/availabilitySets/Read",
					"Microsoft.Compute/locations/*",
					"Microsoft.Compute/virtualMachines/*",
					"Microsoft.Compute/Snapshots/*",
					"Microsoft.Compute/Disks/*",
					"Microsoft.Network/loadBalancers/read",
					"Microsoft.Network/locations/*",
					"Microsoft.Network/networkInterfaces/*",
					"Microsoft.Network/networkSecurityGroups/join/action",
					"Microsoft.Network/networkSecurityGroups/read",
					"Microsoft.Network/networkSecurityGroups/write",
					"Microsoft.Network/publicIPAddresses/join/action",
					"Microsoft.Network/publicIPAddresses/read",
					"Microsoft.Network/publicIPAddresses/write",
					"Microsoft.Network/publicIPPrefixes/read",
					"Microsoft.Network/publicIPPrefixes/join/action",
					"Microsoft.Network/routeTables/join/action",
					"Microsoft.Network/ddosProtectionPlans/read",
					"Microsoft.Network/ddosProtectionPlans/join/action",
					"Microsoft.Network/ddosProtectionPlans/ddosProtectionPlanProxies/read",
					"Microsoft.Network/applicationSecurityGroups/read",
					"Microsoft.Network/applicationSecurityGroups/joinIpConfiguration/action",
					"Microsoft.Network/virtualNetworks/read",
					"Microsoft.Network/virtualNetworks/write",
					"Microsoft.Network/virtualNetworks/subnets/read",
					"Microsoft.Network/virtualNetworks/subnets/join/action",
					"Microsoft.ResourceHealth/availabilityStatuses/read",
					"Microsoft.Resources/deployments/*",
					"Microsoft.Resources/subscriptions/resourceGroups/read",
					"Microsoft.Storage/storageAccounts/listKeys/action",
					"Microsoft.Storage/storageAccounts/*",
					"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
					"Microsoft.Storage/storageAccounts/blobServices/containers/read",
					"Microsoft.Storage/storageAccounts/blobServices/containers/write",
					"Microsoft.KeyVault/vaults/accessPolicies/write",
					"Microsoft.KeyVault/vaults/read",
					"Microsoft.KeyVault/vaults/write",
					"Microsoft.KeyVault/vaults/deploy/action",
					"Microsoft.KeyVault/checkNameAvailability/read",
					"Microsoft.KeyVault/operations/read",
					"Microsoft.KeyVault/vaults/*/read",
					"Microsoft.Compute/proximityPlacementGroups/read",
					"Microsoft.Compute/proximityPlacementGroups/write",
					"Microsoft.Compute/diskEncryptionSets/read",
					"Microsoft.Compute/diskEncryptionSets/write",
					"Microsoft.Compute/restorePointCollections/*",
					"Microsoft.Compute/galleries/read",
					"Microsoft.Compute/galleries/images/read",
					"Microsoft.Compute/galleries/images/versions/read",
					"Microsoft.Compute/diskAccesses/*",
                    "Microsoft.Compute/capacityReservationGroups/deploy/action",
					"Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/read",
					"Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write",
					"Microsoft.ManagedIdentity/userAssignedIdentities/read",
					"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
					"Microsoft.DevTestLab/schedules/write"
				],
				"notActions": [],
				"dataActions": [
					"Microsoft.KeyVault/vaults/secrets/*",
					"Microsoft.KeyVault/vaults/keys/*",
					"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
					"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
					"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
					"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
					"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
                    "Microsoft.Compute/disks/download/action",
                    "Microsoft.Compute/disks/upload/action",
                    "Microsoft.Compute/snapshots/download/action",
                    "Microsoft.Compute/snapshots/upload/action"
				],
				"notDataActions": []
			}
		]
	}
}