{
  "properties": {
    "roleName": "Commvault - Cleanroom",
    "IsCustom": true,
    "description": "A Commvault Role that is used for Cleanroom Recovery",
    "assignableScopes": [
      "/subscriptions/<<Your Subscription ID>>"
    ],
    "permissions": [
      {
        "actions": [
          "Microsoft.Compute/availabilitySets/Read",
          "Microsoft.Compute/diskEncryptionSets/read",
          "Microsoft.Compute/disks/beginGetAccess/action",
          "Microsoft.Compute/disks/delete",
          "Microsoft.Compute/disks/endGetAccess/action",
          "Microsoft.Compute/disks/read",
          "Microsoft.Compute/disks/write",
          "Microsoft.Compute/galleries/images/read",
          "Microsoft.Compute/galleries/images/versions/read",
          "Microsoft.Compute/galleries/read",
          "Microsoft.Compute/locations/*",
          "Microsoft.Compute/proximityPlacementGroups/delete",
          "Microsoft.Compute/proximityPlacementGroups/read",
          "Microsoft.Compute/proximityPlacementGroups/write",
          "Microsoft.Compute/restorePointCollections/*",
          "Microsoft.Compute/snapshots/*",
          "Microsoft.Compute/virtualMachines/*",
          "Microsoft.DevTestLab/schedules/write",
          "Microsoft.KeyVault/checkNameAvailability/read",
          "Microsoft.KeyVault/operations/read",
          "Microsoft.KeyVault/vaults/*/read",
          "Microsoft.KeyVault/vaults/accessPolicies/write",
          "Microsoft.KeyVault/vaults/deploy/action",
          "Microsoft.KeyVault/vaults/read",
          "Microsoft.KeyVault/vaults/write",
          "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
          "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/read",
          "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write",
          "Microsoft.Network/applicationSecurityGroups/joinIpConfiguration/action",
          "Microsoft.Network/applicationSecurityGroups/read",
          "Microsoft.Network/bastionHosts/*",
          "Microsoft.Network/loadBalancers/read",
          "Microsoft.Network/locations/*",
          "Microsoft.Network/natGateways/delete",
          "Microsoft.Network/natGateways/read",
          "Microsoft.Network/natGateways/write",
          "Microsoft.Network/natGateways/join/action",
          "Microsoft.Network/networkInterfaces/*",
          "Microsoft.Network/networkSecurityGroups/delete",
          "Microsoft.Network/networkSecurityGroups/join/action",
          "Microsoft.Network/networkSecurityGroups/read",
          "Microsoft.Network/networkSecurityGroups/write",
          "Microsoft.Network/publicIPAddresses/join/action",
          "Microsoft.Network/publicIPAddresses/read",
          "Microsoft.Network/publicIPAddresses/write",
          "Microsoft.Network/publicIPAddresses/delete",
          "Microsoft.Network/virtualNetworks/delete",
          "Microsoft.Network/virtualNetworks/read",
          "Microsoft.Network/virtualNetworks/subnets/delete",
          "Microsoft.Network/virtualNetworks/subnets/join/action",
          "Microsoft.Network/virtualNetworks/subnets/read",
          "Microsoft.Network/virtualNetworks/subnets/write",
          "Microsoft.Network/virtualNetworks/write",
          "Microsoft.ResourceHealth/availabilityStatuses/read",
          "Microsoft.Resources/deployments/*",
          "Microsoft.Resources/subscriptions/resourceGroups/delete",
          "Microsoft.Resources/subscriptions/resourceGroups/read",
          "Microsoft.Resources/subscriptions/resourceGroups/write",
          "Microsoft.Storage/storageAccounts/blobServices/containers/*",
          "Microsoft.Storage/storageAccounts/blobServices/containers/read",
          "Microsoft.Storage/storageAccounts/blobServices/containers/write",
          "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
          "Microsoft.Storage/storageAccounts/listKeys/action",
          "Microsoft.Storage/storageAccounts/*"
        ],
        "notActions": [],
        "dataActions": [
          "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
        ],
        "notDataActions": []
      }
    ]
  }
}