使用自定义角色进行 Horizon Cloud 应用程序注册

“参与者”角色通常用于启用 Horizon Cloud 应用程序注册过程，以便在 Microsoft Azure 订阅中进行 API 调用。如果您希望避免使用“参与者”角色，则可以创建自定义角色以实现此目的。自定义角色具有某些必需权限和可选权限，在创建服务主体时必须注意这些权限。

要创建自定义角色，请使用 Azure PowerShell 或 Azure CLI 等工具，创建一个包含本主题中所列必需权限的自定义角色定义。有关 Azure 自定义角色的更多信息，请参阅 Azure 资源提供程序操作。

Azure 自定义角色的必需权限

在 Microsoft Azure 中部署 Horizon Edge 时，必须具备以下权限。在订阅级别分配权限时，必须在自定义角色中允许这些 Microsoft Azure 资源操作。

如果您打算使用 App Volumes，请确保在订阅级别配置了这些权限。有关这些权限的更多信息，请参阅 App Volumes 应用程序存储帐户的 Azure 专用端点。

Azure 自定义角色的可选权限

在 Microsoft Azure 中部署 Horizon Edge 时，以下权限不是必需权限。但是，如果不包含这些可选权限，Horizon Universal Console 中依赖这些权限的功能将无法正常工作。在订阅级别分配权限时，可以在自定义角色中选择以下 Microsoft Azure 资源操作。

注意：在删除已加入 Microsoft Entra ID 的池或虚拟机时，服务主体应具有从 Microsoft Entra ID 中删除设备条目的权限。

权限相关内容如下：

范围：https://graph.microsoft.com/

权限：Device.ReadWrite.All Read and write devices

管理员同意：Yes

可通过导航到订阅 > Azure Active Directory > 应用程序注册 > 选择需要授予权限的应用程序 > API 权限 > 选择 Microsoft GRAPH > 选择 Device.ReadWriteAll 来分配该权限。

Microsoft Azure 自定义角色 JSON 示例

以下 JSON 代码块说明了名为 Horizon Cloud Custom Role - Titan 的自定义角色定义在包含上面所列的必需操作和可选操作时的外观。ID 是自定义角色的唯一 ID。使用 Azure PowerShell 或 Azure CLI 创建自定义角色时，该过程会自动生成此 ID。对于变量 my_subscription_ID，请替换将在其中使用自定义角色的订阅的 ID。

在 assignableScopes 部分中，您可以使用多个订阅 ID“/subscriptions/my_subscription_ID”，以允许在多个订阅中使用自定义角色。

请参阅以下示例 JSON，以了解在订阅级别分配权限时允许执行 Horizon Cloud 所需操作的角色。

{
    "id": "uuid",
    "properties": {
        "roleName": "Horizon Cloud Custom Role - Titan",
        "description": "All permissions required for deployment and operation of a Horizon Edge in Azure",
        "assignableScopes": [
              "/subscriptions/my_subscription_ID"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Compute/*/read",
                    "Microsoft.Compute/availabilitySets/*",
                    "Microsoft.Compute/disks/*",
                    "Microsoft.Compute/galleries/read",
                    "Microsoft.Compute/galleries/write",
                    "Microsoft.Compute/galleries/delete",
                    "Microsoft.Compute/galleries/images/*",
                    "Microsoft.Compute/galleries/images/versions/*",
                    "Microsoft.Compute/images/*",
                    "Microsoft.Compute/locations/*",
                    "Microsoft.Compute/snapshots/*",
                    "Microsoft.ContainerService/managedClusters/delete",
                    "Microsoft.ContainerService/managedClusters/read",
                    "Microsoft.ContainerService/managedClusters/write",
                    "Microsoft.ContainerService/managedClusters/commandResults/read",
                    "Microsoft.ContainerService/managedClusters/runcommand/action",
                    "Microsoft.ContainerService/managedClusters/upgradeProfiles/read",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
                    "Microsoft.Compute/virtualMachines/*",
                    "Microsoft.Compute/virtualMachineScaleSets/*",
                    "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/read",
                    "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write",
                    "Microsoft.Network/loadBalancers/*",
                    "Microsoft.Network/networkInterfaces/*",
                    "Microsoft.Network/networkSecurityGroups/*",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
                    "Microsoft.Network/virtualNetworks/subnets/read",
                    "Microsoft.Network/virtualNetworks/subnets/write",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
                    "Microsoft.Network/virtualNetworks/subnets/effectiveRoutingRules/read",
                    "Microsoft.Network/virtualNetworks/subnets/effectiveSecurityUserRules/read",
                    "Microsoft.Network/virtualNetworks/subnets/resourceNavigationLinks/read",
                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read",
                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
                    "Microsoft.ResourceGraph/*",
                    "Microsoft.Resources/deployments/*",
                    "Microsoft.Resources/subscriptions/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/*",
                    "Microsoft.ResourceHealth/availabilityStatuses/read",
                    "Microsoft.Storage/*/read",
                    "Microsoft.Storage/storageAccounts/*",
                    "Microsoft.KeyVault/*/read",
                    "Microsoft.KeyVault/vaults/*",
                    "Microsoft.KeyVault/vaults/secrets/*",
                    "Microsoft.Network/natGateways/join/action",
                    "Microsoft.Network/natGateways/read",
                    "Microsoft.Network/privateEndpoints/write",
                    "Microsoft.Network/privateEndpoints/read",
                    "Microsoft.Network/publicIPAddresses/*",
                    "Microsoft.Network/routeTables/join/action",
                    "Microsoft.Network/routeTables/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}