能否通过ARM模板配置Azure权限？含RBAC资源组只读权限问询

问题1：是否可以通过ARM模板配置权限？ #

Absolutely! ARM templates fully support configuring RBAC (Role-Based Access Control) permissions for Azure resources, resource groups, or even subscriptions. You don’t have to rely solely on PowerShell scripts or VSTS build steps — permission management can be baked directly into your infrastructure-as-code deployments, keeping your resource setup and access controls aligned in one workflow.

问题2：在Azure中，若需通过RBAC为资源组授予只读权限，能否借助ARM模板实现？ #

Definitely. You can define a Microsoft.Authorization/roleAssignments resource within your ARM template to assign the Reader role (or any other built-in/custom role) to a user, group, service principal, or managed identity at the resource group scope.

Here’s a practical example snippet you can adapt for your scenario:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "principalId": {
      "type": "string",
      "metadata": {
        "description": "The object ID of the user/group/service principal to grant access to"
      }
    },
    "readerRoleId": {
      "type": "string",
      "defaultValue": "/subscriptions/{your-subscription-id}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
      "metadata": {
        "description": "Fixed ID for Azure's built-in Reader role"
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceGroup().id, parameters('principalId'), parameters('readerRoleId'))]",
      "properties": {
        "roleDefinitionId": "[parameters('readerRoleId')]",
        "principalId": "[parameters('principalId')]",
        "scope": "[resourceGroup().id]"
      }
    }
  ]
}

A few key details to note:

• The built-in Reader role has a fixed ID (acdd72a7-3385-48ef-bd42-f606fba81ae7) across all Azure subscriptions, so you can use this value directly without manual lookup.
• The name of the role assignment uses the guid() function to generate a unique identifier, avoiding conflicts with existing assignments.
• The scope is set to the current resource group ([resourceGroup().id]), which targets exactly the level you need for read-only access.

This method lets you deploy your resource group and configure its permissions in a single, cohesive deployment — often more streamlined than separate script-based steps.

内容的提问来源于stack exchange，提问作者user3364161