Azure Permission Matrix

Group	Scope	Assignment	Role	Tenant
** azure_M42_Administrators**	Azure RaaS AdministratorsIT Support	Management Group Tenant Root Group/Rhapsody Health	Owner (Built-In)	M42 Rhapsody SaaS Platform 3f777256-3f9d-4a11-a412-9b349bcca7df
** azure_M42_GlobalOps**	GOT Team	Management Group Tenant Root Group/Rhapsody Health / Landing Zones / rhapsody-raasTenant Root Group/Rhapsody Health / Platform	Reader (Built-In)Global Operations Support Role (Custom)

{
    "id": "/providers/Microsoft.Authorization/roleDefinitions/09f0179e-3ffa-44cd-9a42-570a1ccbf40a",
    "properties": {
        "roleName": "Global Operations Support Role",
        "description": "",
        "assignableScopes": [
            "/providers/Microsoft.Management/managementGroups/rhapsody"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
                    "Microsoft.Network/*/read",
                    "Microsoft.Network/*/write",
                    "Microsoft.Compute/virtualMachineScaleSets/*/read",
                    "Microsoft.Compute/virtualMachineScaleSets/*/write",
                    "Microsoft.Insights/*/read",
                    "Microsoft.Storage/*/read",
                    "Microsoft.Storage/*/write",
                    "Microsoft.Support/*",
                    "Microsoft.KeyVault/vaults/read",
                    "Microsoft.KeyVault/vaults/write",
                    "Microsoft.KeyVault/vaults/deploy/action"
                ],
                "notActions": [
                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
                    "Microsoft.Network/*/delete",
                    "Microsoft.Compute/virtualMachineScaleSets/delete",
                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/delete",
                    "Microsoft.Authorization/locks/delete",
                    "Microsoft.Authorization/roleAssignments/*",
                    "Microsoft.Authorization/roleDefinitions/*",
                    "Microsoft.Storage/*/delete",
                    "Microsoft.KeyVault/vaults/delete"
                ],
                "dataActions": [
                    "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
                    "Microsoft.KeyVault/vaults/secrets/getSecret/action",
                    "Microsoft.KeyVault/vaults/secrets/setSecret/action",
                    "Microsoft.KeyVault/vaults/secrets/update/action",
                    "Microsoft.KeyVault/vaults/secrets/backup/action",
                    "Microsoft.KeyVault/vaults/secrets/restore/action"
                ],
                "notDataActions": [
                    "Microsoft.KeyVault/vaults/secrets/delete",
                    "Microsoft.KeyVault/vaults/secrets/purge/action"
                ]
            }
        ]
    }
}

| M42 Rhapsody SaaS Platform 3f777256-3f9d-4a11-a412-9b349bcca7df
azure_M42_Reader| | Management Group Tenant Root Group/Rhapsody Health| Reader (Built-In)| M42 Rhapsody SaaS Platform 3f777256-3f9d-4a11-a412-9b349bcca7df
azure_M42_StorageReader| RaaS Support| Management Group Tenant Root Group/Rhapsody Health / Landing Zones / rhapsody-raas| Limited Storage Reader Role (Built-In)| M42 Rhapsody SaaS Platform 3f777256-3f9d-4a11-a412-9b349bcca7df
mg-Rhapsody-Health-Contributor| | Management Group Tenant Root Group/Rhapsody Health| | Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2
mg-Rhapsody-Health-Global-Ops| GOT Team| Management Group Tenant Root Group/Rhapsody Health / Landing ZonesTenant Root Group/Rhapsody Health / Platform / ManagementTenant Root Group/Rhapsody Health / Platform / Connectivity| Reader (Built-In)Global Operations Support Role (Custom)

{
    "id": "/providers/Microsoft.Authorization/roleDefinitions/09f0179e-3ffa-44cd-9a42-570a1ccbf40a",
    "properties": {
        "roleName": "Global Operations Support Role",
        "description": "",
        "assignableScopes": [
            "/providers/Microsoft.Management/managementGroups/rhapsody"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
                    "Microsoft.Network/*/read",
                    "Microsoft.Network/*/write",
                    "Microsoft.Compute/virtualMachineScaleSets/*/read",
                    "Microsoft.Compute/virtualMachineScaleSets/*/write",
                    "Microsoft.Insights/*/read",
                    "Microsoft.Storage/*/read",
                    "Microsoft.Storage/*/write",
                    "Microsoft.Support/*",
                    "Microsoft.KeyVault/vaults/read",
                    "Microsoft.KeyVault/vaults/write",
                    "Microsoft.KeyVault/vaults/deploy/action"
                ],
                "notActions": [
                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
                    "Microsoft.Network/*/delete",
                    "Microsoft.Compute/virtualMachineScaleSets/delete",
                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/delete",
                    "Microsoft.Authorization/locks/delete",
                    "Microsoft.Authorization/roleAssignments/*",
                    "Microsoft.Authorization/roleDefinitions/*",
                    "Microsoft.Storage/*/delete",
                    "Microsoft.KeyVault/vaults/delete"
                ],
                "dataActions": [
                    "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
                    "Microsoft.KeyVault/vaults/secrets/getSecret/action",
                    "Microsoft.KeyVault/vaults/secrets/setSecret/action",
                    "Microsoft.KeyVault/vaults/secrets/update/action",
                    "Microsoft.KeyVault/vaults/secrets/backup/action",
                    "Microsoft.KeyVault/vaults/secrets/restore/action"
                ],
                "notDataActions": [
                    "Microsoft.KeyVault/vaults/secrets/delete",
                    "Microsoft.KeyVault/vaults/secrets/purge/action"
                ]
            }
        ]
    }
}

| Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2
mg-Rhapsody-Health-Owner| Azure RaaS AdministratorsIT Support| Management Group Tenant Root Group/Rhapsody Health| Owner (Built-In)| Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2
mg-Rhapsody-Health-RCP-Owner| RCP Squad| Management Group Tenant Root Group/Rhapsody Health / Landing Zones / rhapsody-rcp| Owner (Built-In)| Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2
mg-Rhapsody-Health-Reader| | Management Group Tenant Root Group/Rhapsody Health| | Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2
mg-RaaS-Azure-Billing| Finance| Management Group Tenant Root Group/Rhapsody Health| Billing Reader (Built-In)| Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2
mg-Landing-Zones-Owner| | Management Group Tenant Root Group/Rhapsody Health / Landing Zones| Owner (Built-In)| Rhapsody SaaS Platform 1e8f5a77-9414-43af-b4c8-268c61adcfd2