PRIMECLUSTER Installation and Administration Guide4.7 Cloud Services

29.1.3 Changing the Role of the Service Principal

When changing the role of a service principal, note the following.

For the Azure resources (ResourceID and RouteTableID) specified in SA_vmazureReset.cfg and hvazurenicconfig, set a role that has privileges for the following operations.

• Microsoft.Compute/virtualMachines/read

• Microsoft.Compute/virtualMachines/start/action

• Microsoft.Compute/virtualMachines/powerOff/action

• Microsoft.Network/routeTables/read

• Microsoft.Network/routeTables/routes/read

• Microsoft.Network/routeTables/routes/write

• Microsoft.Network/networkInterfaces/read

• Microsoft.Network/networkInterfaces/write

• Microsoft.Network/virtualNetworks/subnets/join/action

Note that depending on your environment, a role may require additional privileges.

Set permissions on the role if:.

If you assign a public IP to the network interface:

Microsoft.Network/publicIPAddresses/join/action

If you have associated a network security group with a network interface:

Microsoft.Network/networkSecurityGroups/join/action