使用自訂角色來登錄 Horizon Cloud 應用程式

參與者角色通常用於啟用 Horizon Cloud 應用程式登錄程序，以便在 Microsoft Azure 訂閱中進行 API 呼叫。如果您不想使用參與者角色，可以為此目的建立自訂角色。自訂角色具有某些必要權限和選用權限，您在建立服務主體時必須注意。

若要建立自訂角色，請使用 Azure PowerShell 或 Azure CLI 等工具，建立包含本主題所列必要權限的自訂角色定義。如需有關 Azure 自訂角色的詳細資訊，請參閱 Azure 資源提供者作業。

Azure 自訂角色的必要權限

在 Microsoft Azure 中部署 Horizon Edge 時，下列權限為必要項目。在訂閱層級指派權限時，必須在自訂角色中允許這些 Microsoft Azure 資源作業。

如果您打算使用 App Volumes，請確保已在訂閱層級設定相關權限。如需這些權限的詳細資訊，請參閱 App Volumes 應用程式儲存區帳戶的 Azure 私人端點。

Azure 自訂角色的選用權限

如果是在 Microsoft Azure 中部署 Horizon Edge，則以下權限不是必要的。但是，如果您未包含這些選用權限，則依賴這些權限的 Horizon Universal Console 功能將無法運作。在訂閱層級指派權限時，下列 Microsoft Azure 資源作業在自訂角色中為選用項目。

附註：當刪除加入 Microsoft Entra ID 的集區或虛擬機器時，服務主體必須具有從 Microsoft Entra ID 刪除裝置項目的權限。

這些權限如下所示：

範圍：https://graph.microsoft.com/

權限：Device.ReadWrite.All Read and write devices

管理員同意：Yes

您可以透過導覽至訂閱 > Azure Active Directory > 應用程式登錄 > 選取需要授與權限的應用程式 > API 權限 > 選取 Microsoft GRAPH > 選取 Device.ReadWriteAll 來指派此權限。

Microsoft Azure 自訂角色 JSON 範例

下列 JSON 程式碼區塊示範了一個名為 Horizon Cloud Custom Role - Titan 的自訂角色定義範例，當中包含上述必要與選用的作業。識別碼為自訂角色的唯一識別碼。使用 Azure PowerShell 或 Azure CLI 來建立自訂角色時，該程序會自動產生此識別碼。對於變數 my_subscription_ID，請替換為將使用此自訂角色的訂閱識別碼。

在 assignableScopes 區段中，您可以使用多個訂閱識別碼 (如「/subscriptions/my_subscription_ID」)，讓自訂角色可跨多項訂閱使用。

以下範例 JSON 示範了一個角色，在訂閱層級指派權限時允許 Horizon Cloud 所需的作業。

{
    "id": "uuid",
    "properties": {
        "roleName": "Horizon Cloud Custom Role - Titan",
        "description": "All permissions required for deployment and operation of a Horizon Edge in Azure",
        "assignableScopes": [
              "/subscriptions/my_subscription_ID"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Compute/*/read",
                    "Microsoft.Compute/availabilitySets/*",
                    "Microsoft.Compute/disks/*",
                    "Microsoft.Compute/galleries/read",
                    "Microsoft.Compute/galleries/write",
                    "Microsoft.Compute/galleries/delete",
                    "Microsoft.Compute/galleries/images/*",
                    "Microsoft.Compute/galleries/images/versions/*",
                    "Microsoft.Compute/images/*",
                    "Microsoft.Compute/locations/*",
                    "Microsoft.Compute/snapshots/*",
                    "Microsoft.ContainerService/managedClusters/delete",
                    "Microsoft.ContainerService/managedClusters/read",
                    "Microsoft.ContainerService/managedClusters/write",
                    "Microsoft.ContainerService/managedClusters/commandResults/read",
                    "Microsoft.ContainerService/managedClusters/runcommand/action",
                    "Microsoft.ContainerService/managedClusters/upgradeProfiles/read",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
                    "Microsoft.Compute/virtualMachines/*",
                    "Microsoft.Compute/virtualMachineScaleSets/*",
                    "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/read",
                    "Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/write",
                    "Microsoft.Network/loadBalancers/*",
                    "Microsoft.Network/networkInterfaces/*",
                    "Microsoft.Network/networkSecurityGroups/*",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
                    "Microsoft.Network/virtualNetworks/subnets/read",
                    "Microsoft.Network/virtualNetworks/subnets/write",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
                    "Microsoft.Network/virtualNetworks/subnets/effectiveRoutingRules/read",
                    "Microsoft.Network/virtualNetworks/subnets/effectiveSecurityUserRules/read",
                    "Microsoft.Network/virtualNetworks/subnets/resourceNavigationLinks/read",
                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read",
                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
                    "Microsoft.ResourceGraph/*",
                    "Microsoft.Resources/deployments/*",
                    "Microsoft.Resources/subscriptions/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/*",
                    "Microsoft.ResourceHealth/availabilityStatuses/read",
                    "Microsoft.Storage/*/read",
                    "Microsoft.Storage/storageAccounts/*",
                    "Microsoft.KeyVault/*/read",
                    "Microsoft.KeyVault/vaults/*",
                    "Microsoft.KeyVault/vaults/secrets/*",
                    "Microsoft.Network/natGateways/join/action",
                    "Microsoft.Network/natGateways/read",
                    "Microsoft.Network/privateEndpoints/write",
                    "Microsoft.Network/privateEndpoints/read",
                    "Microsoft.Network/publicIPAddresses/*",
                    "Microsoft.Network/routeTables/join/action",
                    "Microsoft.Network/routeTables/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}