# Role and Permission Requirements for Protecting Azure Resources

For most Azure resources, Commvault provides a custom role that includes the permissions that are required to protect the resources. In non-production environments, you can use Azure built-in roles instead. For VMs encrypted with Azure Key Vault, you can use a custom role or an access policy, but access policies are less secure and are considered by Microsoft to be a legacy authorization system.

If there is no custom role for an Azure resource that you want to protect, you can create your own custom role.

For instructions to assign roles, see Assign Azure roles using the Azure portal.

## Custom role files

Azure resources | Custom role for Azure portal | Custom role for Azure CLI
--- | --- | ---
Azure Cosmos DB for Cassandra, MongoDB, NoSQL, and Table | AzureDBBackupRole.json | AzureDBBackupRole_CLI.json
Azure Database for MariaDB, MySQL, and PostgreSQL | AzureDBBackupRole.json | AzureDBBackupRole_CLI.json
Azure SQL Database | AzureSQLDBBackupRole.json | AzureSQLDBBackupRole_CLI.json
Azure SQL Managed Instance | AzureSQLDBManagedBackupRole.json | AzureSQLDBManagedBackupRole_CLI.json
Azure Table Storage | AzureDBBackupRole.json | AzureDBBackupRole_CLI.json
Azure VMs | Commvault-VM-Protection-Advanced.json | Commvault-VM-Protection-Advanced.json
Azure Blob Storage | AzureBlobADLSGen2BackupRole.json | None
Azure Data Lake Storage Gen2 | AzureBlobADLSGen2BackupRole.json | None
Azure File Storage | AzureFileBackupRole.json | None

## Permissions for Azure auto-scaling

To configure Azure auto-scaling, set the permissions in the CommvaultAzureCVAutoScale.json file.

Important

In the JSON file, change placeholder values such as `{subscription-id}`.

## Built-in roles

Azure resources | Assign to the subscription | Assign to the storage account
--- | --- | ---
Azure Cosmos DB for Cassandra, MongoDB, NoSQL, and Table Azure Database for MariaDB, MySQL, and PostgreSQL | Contributor Blob Storage Contributor | None
Azure SQL Database Azure SQL Managed Instance | SQL Server Contributor SQL Managed Instance Contributor Blob Storage Contributor | None
Azure VMs, encrypted | Contributor Data Operator for Managed Disks Storage Blob Data Contributor Key Vault Crypto Officer Key Vault Secrets Officer | None
Azure VMs, unencrypted | Contributor Data Operator for Managed Disks Storage Blob Data Contributor | None
Azure Blob Storage Azure Data Lake Storage Gen2 | Storage Blob Data Owner Reader Storage Account Contributor | None
Azure File Storage | Storage Account Contributor Reader | Storage Blob Data Contributor Storage File Data Privileged Contributor

## Permissions for confidential VMs encrypted with Azure key vault using RBAC

To restore confidential VMs that are encrypted using Azure Key Vault with RBAC, assign the following roles:

Azure resources | Assign to the Confidential VM Orchestrator built-in app | Assign to your Azure application
--- | --- | ---
Confidential VMs, encrypted using Azure Key Vault with RBAC | Key Vault Crypto Service Release User | Key Vault Data Access Administrator

## Permissions for VMs encrypted with Azure key vault using access policies (legacy authorization system)

For Azure VMs that are encrypted with Key Vault, instead of using a custom role that you assign to your Azure Key Vault application, you can create an access policy and assign it to the Azure VM or the Azure Key Vault application that functions as your service principal.

For instructions to create an access policy in the Azure portal, see Assign a Key Vault access policy (legacy).

Azure resources | Permissions to select for both Key permissions and Secret permissions
--- | ---
VMs, encrypted using Azure Key Vault with access policies | Get Recover Backup Restore

Note

The Commvault software does not support VMs that are encrypted with Azure Key Vault for managing certificates.

×

Loading...