Add a Custom Role Assignment
[This is only needed if DNS Proxy requires an Azure Subscription ID to synch - Raimonds investigating]
[Subscription ID is hard coded into the script below, so if this topic is being used it will need to be a variable]
Follow the steps below to add a custom role assignment.
Sign in to your Microsoft Azure portal at Microsoft Azure Portal
.Enter subscriptions in search and select
Subscriptions to open the Subscription page.Select the subscription to which you deployed DNS Proxy and the Subscription page opens.
From the side bar menu, select
Access control (IAM) and the Access control (IAM) page opens.Select Add > Add custom role and the Create a custom role page displays.
Select the JSON tab and select Edit.
Copy the following JSON and paste it into the text box, overwriting the existing JSON:
{ "properties": { "roleName": "AzureADAgent Resource Reader", "description": "Read ResourceGroups, Virtual Machine & Network Interface Data", "assignableScopes": [ "/subscriptions/3f51630f-4c88-4fba-b57a-5c39b5662a2f" ], "permissions": [ { "actions": [ "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkInterfaces/diagnosticIdentity/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Resources/subscriptions/resourceGroups/read" ], "notActions": [], "dataActions": [], "notDataActions": [] } ] } }Select Save to save the contents of the JSON text box and then select Next.
Select Create. You have now created a custom role named AzureADAgent Resource Reader.
Note
It can take a number of minutes for a custom role to propagate throughout the tenant.
Return to the Subscriptions page and from the side bar menu select
Access control (IAM). The Access control (IAM) page opens.Select the Roles tab and in the search bar and enter AzureADAgent Resource Reader.
On the Subscriptions page, select Access control (IAM) in the left-hand menu and click Add Role Assignment. The Add role assignment window displays:
From the Role menu, select AzureAD Agent Resource Reader.
From the Assign access to menu, select User, group, or service principal.
From the Select menu, select DNSProxy.
Click Save.