Welcome to this module on Planning and Implementing Azure Roles and Role-Based Access Control or RBAC for Azure Virtual Desktop. In this module, we'll cover the following topics, what is role-based access control or RBAC? We'll discuss some of the Azure Virtual Desktop specific built-in roles. Finally, we'll talk about delegated access in Azure Virtual Desktop.

Let's start by discussing what role-based access control, better known as RBAC, is. It allows you to manage who has access to resources within Azure. It is an authorization mechanism that is built on Azure Resource Manager, better known as ARM, that allows administrators to configure fine-grained access management to resources.

There are three elements to role-based access control. The first is a security principle, which represents some type of object, for example, a user or a group. The second type of element, is role definition, which is a collection or a set of permissions. Essentially a role definition lists the actions. For example, read, write or delete, that can be performed. The final element is a scope. This is a set of resources to which the access is applying to. There are different levels of scope, including management groups, subscriptions and resource groups.

In the next part of this course, we are going to look at some of the built-in roles that are relevant to Azure Virtual Desktop. We start off with desktop virtualization role, which has a reader role and a contributor role. The reader role allows you to view all aspects of the deployment, but not make any changes. The contributor role enables you to manage all parts of the deployment, however, it does not allow you to access to any of the compute resources.

The next relevant role is the desktop virtualization host pool role, which again, has a reader and contributor level access. The reader level allows you to view all aspects of the host pool only and not modify any settings, whereas a contributor role allows you to manage everything within the host pool. However, you do need an additional contributor role for the virtual machine, if you wish to create any VMs. The desktop application group role, is similar to the host pool role, in that it has both reader and contributor levels. With the reader level role, it allows you to view everything within the application group and the contributor level, allow you to manage everything within the application groups. However, if you wish to publish apps, you need to have the user access administrator role.

Next, we have the desktop virtualization workspace role, which again has two levels, reader and contributor. The reader level role allows you to view all aspects of the workspace but not adding anything. The contributor level role allows you to manage everything within the workspace. However, to obtain information on applications within that app group, you need to be assigned the application group reader role. There are two more roles that are relevant to Azure Virtual Desktop. The first is the desktop virtualization user session operator. This role allows you to manage user logins and to do tasks such as sending messages, disconnecting sessions, and remotely logging users off by sessions.

The final role is called desktop virtualization session host operator. This role will enable you to change drain mode and view and remove session hosts from a host pool. This level of access does not have right permissions, however, so you cannot add session host into the host pool. In the final section of this module, we are going to view delegated access with Azure Virtual Desktop.

Like role-based access control, delegated access has the same three elements, which are security principles, role definitions, and scope. Security principles have three values, which are all objects, including users, groups, and service principles. Role definitions have two type of roles. Either built-in roles, which we discussed in the previous section of this module and custom roles. These are roles you can customize with different permissions. Finally, we have the scope elements of delegated access. As mentioned earlier, this is the resources you assign the roles and permissions to, which include host pools, app groups, and workspaces.