Movatterモバイル変換

Azure DevTest Labs has three built-in roles:Owner,Contributor, andDevTest Labs User, that define the access necessary to do specific lab tasks. Lab owners use Azurerole-based access control (RBAC) to add lab users with assigned roles. This article lists the tasks each role can do, and describes how Lab Owners can add members to lab roles by using the Azure portal or an Azure PowerShell script.

Owners, Contributors, and DevTest Labs Users

The following table shows the actions that the DevTest LabsOwner,Contributor, andDevTest Labs User roles can take.

Action	Owner	Contributor	DevTest Labs User
Lab tasks
Create labs.	X	X
Add users to labs.	X
Configure user settings and roles.	X
Update lab virtual machine (VM) policies.	X	X
Update cost settings.	X	X
VM base tasks
Enable Marketplace images.	X	X
Add, update, and delete VM base formulas.	X	X	X
Add and remove custom images.	X	X
Add, update, and delete formulas.	X	X
Individual VM tasks
Create VMs.	X	X	X
Start, stop, or delete owned VMs.	X	X	X
Add or remove VM data disks.	X	X	X
Artifact and template tasks
Add and remove lab artifact and template repositories.	X	X
Create artifacts and templates.	X	X	X
Apply artifacts to owned VMs.	X	X	X

Note

Lab users automatically have theOwner role on VMs they create.

Lab Owner role

Azure permissions propagate from parent scope to child scope. Owners of an Azure subscription that contains labs are automaticallyOwners of the subscription's labs.

Azure subscriptionOwners andUser Access Administrators can add and assign DevTest LabsOwners,Contributors, andDevTest Labs Users to labs in their subscriptions. Azure subscriptionContributors can create labs, but they'reOwners of those labs only if a subscription Owner or User Access Administrator assigns them the labOwner role.

Lab users that are granted theOwner role can add and assignOwners,Contributors, andDevTest Labs Users for their own labs. However, added lab owners have a narrower scope of administration than Azure subscription-based owners. Added owners don't have full access to some resources that the DevTest Labs service creates.

Prerequisites

You must be a labOwner, either by assignment from a subscription owner or by inheritance as a subscription owner.
The user to be added must have a validMicrosoft account. They don't need an Azure subscription.

You must be a labOwner, either by assignment from a subscription owner or by inheritance as a subscription owner.
The user to add must have a validMicrosoft account. They don't need an Azure subscription.
This PowerShell script requires the added user to be in the Microsoft Entra ID. You can add an external user to Microsoft Entra ID as a guest. For more information, seeAdd a new guest user. If you can't add the user to Microsoft Entra ID, use the portal procedure instead.
You need access to Azure PowerShell. You can either:
- Use Azure Cloud Shell. Be sure to select thePowerShell environment in Cloud Shell.
- Install Azure PowerShell to use on a physical or virtual machine. If necessary, runUpdate-Module -Name Az to update your installation.

Add a user to a lab

Lab Owners can add members to lab roles by using the Azure portal or an Azure PowerShell script.

The following procedure adds a user to a lab withDevTest Labs User role. If you're an owner of the Azure subscription the lab is in, you can also do this procedure from the subscription'sAccess control (IAM) page.

On the lab's home page, selectConfiguration and policies from the left navigation.
On theConfiguration and policies page, selectAccess control (IAM) from the left navigation.
SelectAdd >Add role assignment or select theAdd role assignment button.
On theAdd role assignment page, search for and select theDevTest Labs User role, and then selectNext.
On theMembers tab, selectSelect members.
On theSelect members screen, search for and select the members you want to add, and then selectSelect.
SelectReview + assign, and after reviewing the details, selectReview + assign again to add the members.

The following PowerShell script adds a user to a lab withDevTest Labs User role. To use the script, replace the parameter values under the# Values to change comment with your own values. You can get thesubscriptionId,labResourceGroup, andlabName values from the lab's main page in the Azure portal.

# Values to change$subscriptionId = "<Azure subscription ID>"$labResourceGroup = "<Lab resource group name>"$labName = "<Lab name>"$userDisplayName = "<User display name>"# Sign into your Azure account.Connect-AzAccount# Select the Azure subscription that contains the lab. This step is optional if you have only one subscription.Select-AzSubscription -SubscriptionId $subscriptionId# Get the user object.$adObject = Get-AzADUser -SearchString $userDisplayName# Create the role assignment. $labId = ('/subscriptions/' + $subscriptionId + '/resourceGroups/' + $labResourceGroup + '/providers/Microsoft.DevTestLab/labs/' + $labName)New-AzRoleAssignment -ObjectId $adObject.Id -RoleDefinitionName 'DevTest Labs User' -Scope $labId

Movatterモバイル変換

Share via

Add and configure lab users in Azure DevTest Labs

In this article

Owners, Contributors, and DevTest Labs Users

Lab Owner role

Prerequisites

Add a user to a lab

Related content

Feedback

Additional resources

In this article