Skip to content

Create a custom role to assign to the Application

  1. Create a Custom Role that will be assigned to the application created for the Valtix Controller. The Custom Role gives the application permissions to read inventory information and create resources (e.g., VMs, Load Balancers, etc.) The Custom Role can be created in multiple ways. One of the easiest ways is to navigate to your Subscription and click Access Control (IAM)
  2. Click on Roles and on the top menu bar above Roles click +Add > Add Custom Role
  3. Give a name to the Custom Role (e.g., valtix-controller-role)
  4. Keep clicking Next until you get to the JSON editing screen

  5. Click Edit on the screen and in the JSON text, under the permissions -> actions section, copy and paste the following content between the square brackets (no need to maintain the indentation):

    "Microsoft.ApiManagement/service/*",
"Microsoft.Compute/disks/*",
"Microsoft.Compute/diskEncryptionSets/read",
"Microsoft.Compute/images/read",
"Microsoft.Compute/sshPublicKeys/read",
"Microsoft.Compute/virtualMachines/*",
"Microsoft.ManagedIdentity/userAssignedIdentities/read",
"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
"Microsoft.Network/loadBalancers/*",
"Microsoft.Network/locations/serviceTags/read",
"Microsoft.Network/networkinterfaces/*",
"Microsoft.Network/networkSecurityGroups/*",
"Microsoft.Network/publicIPAddresses/*",
"Microsoft.Network/routeTables/*",
"Microsoft.Network/virtualNetworks/*",
"Microsoft.Resources/subscriptions/resourcegroups/*",
"Microsoft.Storage/storageAccounts/blobServices/*",
"Microsoft.Storage/storageAccounts/listkeys/action",
"Microsoft.Network/networkWatchers/*",
"Microsoft.Network/applicationSecurityGroups/*"

    This is an example screenshot of how the Custom Role JSON actions should look after pasting the above content:

    Custom Role JSON

  6. Optional - If you plan to use multiple Subscriptions with Valtix, you must edit the JSON at assignableScopes to add another Subscription line or change it to * (star) so the Custom Role can be used with all Subscriptions

  7. Click Save at the top of the text box
  8. Click Review + Create and create the role
  9. Once the Custom Role is created return to Access Control (IAM)
  10. On the top menu bar, Click Add -> Add role assignment
  11. In the Role dropdown, select the Custom Role created above
  12. In the Assign access to dropdown leave it as the default (Azure AD user, group, service principal)
  13. In the Select text box, type in the name of the application created earlier (e.g. valtixcontrollerapp) and click Save
  14. In the Subscription page, click on the Overview in the left menu bar and copy the Subscription ID to the notepad

Required Values For Valtix Controller Onboarding

Make sure you have the following information before proceeding further:

  • Subscription ID (from subscription overview page)
  • Directory (Tenant) ID (from the Azure AD app overview page)
  • Application (client) ID (from the Azure AD app overview page)
  • Client Secret (Copied when the Client secret was created)