Prezados Desejo a alterar a ação Microsoft.LabServices/labAccounts/labs/write. Essa ação é responsável por liberar ou não qualquer alteração dentro do laboratório e preciso criar uma função que realize apenas algumas dessas alterações. É possível editar os parâmetros dessa ação de modo a definir o que ela faz ou não. Ou então clonar ela e redefinir os parâmetros ?

Hello @Diogo Mendonça Currently Q&A is only supported in English languages only. Hence, i used language translator to understand your question and answering in english. Hope this works for you.. The Microsoft.LabServices/labAccounts/labs/write action is a built-in role-based access control (RBAC) action that allows users to create, update, and delete labs within a lab account. This action is defined by Microsoft and cannot be edited or modified by users. However, you can create a custom role that includes only the permissions that you need for your specific use case. To do this, you can clone an existing role and modify its permissions as needed. For example, you can clone the Lab Creator role, which includes the Microsoft.LabServices/labAccounts/labs/write action, and then remove any permissions that you do not need. To create a custom role, you can use the Azure portal, Azure PowerShell, or Azure CLI. Here is an example of how to create a custom role using Azure PowerShell: # Clone the Lab Creator role In this example, the Microsoft.LabServices/labAccounts/labs/delete action is removed from the permissions of the cloned role, resulting in a custom role that can create and manage labs but cannot delete them. If you have any further queries, let me know by tagging me in your comments. Please 'Accept Answer' and upvote if the above information is helpful for the benefit of the community.

Editar a ação Microsoft.LabServices/labAccounts/labs/write

Accepted answer

Prrudram-MSFT 22,941 Reputation points

2023-05-20T19:19:02.2866667+00:00
Hello @Diogo Mendonça

Currently Q&A is only supported in English languages only. Hence, i used language translator to understand your question and answering in english. Hope this works for you..

The Microsoft.LabServices/labAccounts/labs/write action is a built-in role-based access control (RBAC) action that allows users to create, update, and delete labs within a lab account. This action is defined by Microsoft and cannot be edited or modified by users.

However, you can create a custom role that includes only the permissions that you need for your specific use case. To do this, you can clone an existing role and modify its permissions as needed. For example, you can clone the Lab Creator role, which includes the Microsoft.LabServices/labAccounts/labs/write action, and then remove any permissions that you do not need.

To create a custom role, you can use the Azure portal, Azure PowerShell, or Azure CLI. Here is an example of how to create a custom role using Azure PowerShell:

# Clone the Lab Creator role

In this example, the Microsoft.LabServices/labAccounts/labs/delete action is removed from the permissions of the cloned role, resulting in a custom role that can create and manage labs but cannot delete them.

If you have any further queries, let me know by tagging me in your comments.

Please 'Accept Answer' and upvote if the above information is helpful for the benefit of the community.
Please sign in to rate this answer.
Diogo Mendonça 30 Reputation points

2023-05-22T19:50:58.47+00:00

Good afternoon @Prrudram-MSFT ! Thank you for your reply.

But my need to edit the Microsoft.LabServices/labAccounts/labs/write action is precisely to create a function that does the following:

A - start, stop, edit and publish the lab model;

B - Add, remove and send invitation emails to lab students.

C - Change the number of machines available in the laboratory;

D - Start, stop and access the laboratory students' machine;

E - Do not schedule events in the laboratory;

F - Do not change the usage time quotas for students.

The actions of this role are currently as follows:

01 - Microsoft.LabServices/labAccounts/labs/read

02 - Microsoft.LabServices/labAccounts/labs/write

03 - Microsoft.LabServices/labAccounts/labs/environmentSettings/read

04 - Microsoft.LabServices/labAccounts/labs/users/read

05 - Microsoft.LabServices/labAccounts/labs/environmentSettings/Start/action

06 - Microsoft.LabServices/labAccounts/labs/environmentSettings/Stop/action

07 - Microsoft.LabServices/labAccounts/labs/environmentSettings/Publish/action

08 - Microsoft.LabServices/labAccounts/labs/users/delete

09 - Microsoft.LabServices/labAccounts/labs/AddUsers/action

10 - Microsoft.LabServices/labAccounts/labs/SendEmail/action

11 - Microsoft.LabServices/labAccounts/labs/environmentSettings/environments/read

12 - Microsoft.LabServices/labAccounts/labs/environmentSettings/environments/Start/action

13 - Microsoft.LabServices/labAccounts/labs/environmentSettings/environments/Stop/action

With these actions I was able to configure functionalities from A to E. As for F, I can restrict the option of "Define additional quotas for users" as exemplified in the "Azure Lab Services Documentation" in the link (https://video2.skills-academy.com/en-us/azure/lab-services/how-to-configure-student-usage#set-additional-quotas-for-specific-users).

However, I was not able to restrict the option Set quotas for users as exemplified in the "Azure Lab Services Documentation" in the link (https://video2.skills-academy.com/en-us/azure/lab-services/how-to-configure-student-usage#set-quotas-for-users). And the action that activates this functionality is Microsoft.LabServices/labAccounts/labs/write.

Is it possible that I create a new action that meets my need to restrict Item F?

If not, is there another form of configuration that meets functionalities A to E, including F?

Obs.: Original in Portuguese.

Boa Tarde @Prrudram-MSFT ! Agradeço a sua resposta .

Mas a minha necessidade de editar a ação Microsoft.LabServices/labAccounts/labs/write é justamente para criar uma função que realize o seguinte:

A - iniciar, interromper, editar e publicar o modelo do laboratório;

B - Adicionar, remover e enviar e-mails de convite para os alunos do laboratório.

C - Alterar a quantidade de máquinas disponíveis no laboratório;

D - Iniciar, interromper e acessar a máquina dos alunos do laboratório;

E - Não agende eventos no laboratório;

F - Não altere as cotas de hora de uso dos alunos.

As ações dessa função atualmente são as seguintes:

01 - Microsoft.LabServices/labAccounts/labs/read

02 - Microsoft.LabServices/labAccounts/labs/write

03 - Microsoft.LabServices/labAccounts/labs/environmentSettings/read

04 - Microsoft.LabServices/labAccounts/labs/users/read

05 - Microsoft.LabServices/labAccounts/labs/environmentSettings/Start/action

06 - Microsoft.LabServices/labAccounts/labs/environmentSettings/Stop/action

07 - Microsoft.LabServices/labAccounts/labs/environmentSettings/Publish/action

08 - Microsoft.LabServices/labAccounts/labs/users/delete

09 - Microsoft.LabServices/labAccounts/labs/AddUsers/action

10 - Microsoft.LabServices/labAccounts/labs/SendEmail/action

11 - Microsoft.LabServices/labAccounts/labs/environmentSettings/environments/read

12 - Microsoft.LabServices/labAccounts/labs/environmentSettings/environments/Start/action

13 - Microsoft.LabServices/labAccounts/labs/environmentSettings/environments/Stop/action

Com essas ações consegui configurar as funcionalidades de A a E. Já quanto a F consigo restringir a opção de "Definir cotas adicionais para usuários" como exemplificado na "Documentação do Azure Lab Services" no link (https://video2.skills-academy.com/pt-br/azure/lab-services/how-to-configure-student-usage#set-additional-quotas-for-specific-users).

Entretanto não consegui restringir a opção Definir cotas para usuários como exemplificado na "Documentação do Azure Lab Services" no link (https://video2.skills-academy.com/pt-br/azure/lab-services/how-to-configure-student-usage#set-quotas-for-users). E a ação que ativa essa funcionalidade é a Microsoft.LabServices/labAccounts/labs/write. Por isso perguntei se é possível editar ela.

É possível que eu crie uma nova ação que atenda a minha necessidade de restringir o Item F?

Caso não, existe outra forma de configuração que atenda as funcionalidades de A a E, inclusive a F?

Prrudram-MSFT 22,941 Reputation points

2023-05-23T08:02:29.94+00:00

Hello! Thanks for clarifying your need. Unfortunately, you cannot create a new action that restricts the "Set quotas for users" option in Azure Lab Services. The Microsoft.LabServices/labAccounts/labs/write action is required to enable editing of lab settings, including student usage time quotas.
However, you can restrict access to this option by setting the correct user permissions. You can create a new custom role that includes all the actions required for functionality A through E, but deletes the Microsoft.LabServices/labAccounts/labs/write action. You can then assign this custom role to users who need access to the lab but do not need to set usage time quotas.

Hope this helps! If you need to discuss further, I would recommend raising a technical support case. If you don't have an active support plan to create a case let me know i will help you.

Diogo Mendonça 30 Reputation points

2023-05-23T13:40:23.37+00:00

Good morning @Prrudram-MSFT , Thanks for the reply!

I performed the following tests,

First Test: Added to a function I created, all 78 Microsoft.LabServices actions, and deleted the Microsoft.LabServices/labAccounts/labs/write action. All actions within the Lab were blocked and the following message appears at the top of the Lab screen: “You are not allowed to make changes in this lab. Please contact your Lab Services administrator for additional permissions.”

Second Test: I just added two actions to the function, the Microsoft.LabServices/labAccounts/labs/read that lets you see the lab and the Microsoft.LabServices/labAccounts/labs/write action. With just these two actions the "Set quotas for users" functionality is already activated.

I do not have an active support plan to create a case. Can you help me?

Prrudram-MSFT 22,941 Reputation points

2023-05-25T03:57:50.3533333+00:00

Hi Diogo Mendonça
Please send an email with your Subscription ID and link to this thread to AzCommunity@microsoft.com with subject line as "ATTN: Priyanka". I can then enable your subscription for one-time free support.

Also, once you get the issue fixed, I request you to update here on the thread with the resolution steps for the benefit of the community.

Diogo Mendonça 30 Reputation points

2023-05-25T12:57:15.9+00:00

Dear Prrudram-MSFT, good morning!

As requested data for email AzCommunity@microsoft.com

Diogo Mendonça 30 Reputation points

2023-05-25T12:59:00.1166667+00:00

Dear Prrudram-MSFT, good morning!

Thanks for the assistance. As requested, I sent the data to the email AzCommunity@microsoft.com

Prrudram-MSFT 22,941 Reputation points

2023-06-16T04:36:10.55+00:00

Diogo Mendonça

Please check for my email.

Diogo Mendonça 30 Reputation points

2023-06-26T16:22:53.6366667+00:00

Dear Priyanka Rudramaina, Good morning! | Prezada Priyanka Rudramaina, Bom Dia!

I tried the procedure informed in the email | Tentei o procedimento informado no email

But when clicking on "NEXT" the result is the one of the attached image | Mas ao clicar em "AVANÇAR" o resultado é o da imagem

Can you help me? | Pode me auxiliar?
Sign in to comment

Share via

Editar a ação Microsoft.LabServices/labAccounts/labs/write

0 additional answers