Azure find out which permission is needed for certain action

Question

I am trying to give permissions to manage locks on resource groups. Atm I gave permission to write locks with following permissions. "Microsoft.Authorization/", "Microsoft.Authorization/locks/" But the person is only able to manage locks on resources, not on resource groups.

Is there an easy way to find out which permission is needed to perform a certain action?

Answer 1

You can assign User Access Administrator to that specific User in the Subscription Scope . You can go to Subscription >> IAM >> Add role Assignment and select User Access Administration and then in members select the user you want to give permissions.

OR

If you want to give only access to locks then you can create a Custom Role following the below steps :

1. Go to Subscription>> IAM>> Add>> Add a Custom Role.
2. Give Custom Role Name and select Start from Scratch.
3. In Permissions Tab , Click Add Permissions and search for Microsoft.Autorization and select it and then again search for Microsoft.Autorization/Locks and select the three permissions as shown below and click on Add:
4. In all other tabs let it be default and in last tab i.e. review+create , click on create. Once its created Go to Subscriptions >> IAM >> Add >> Add role assignment and search the newly created role and assign it to the user you want .

Note : If you are assigning the permissions on Resource Group Level then you will be only able to manage the locks of the resources present inside the resource group , but if you assign the same permissions on Subscription Level then you can manage locks on resource groups as well as resources.