Quantcast
Viewing latest article 3
Browse Latest Browse All 12366

I cannot see the Long-Term Retention (LTR) backups

Sometimes a user is assigned permissions at Resource Group level or Resource level.
When using Long-Term Retention we have several advantages like each backup will be kept in the long-term storage for the period specified by these parameters or the database can be restored to any existing server under the same subscription as the original database.

Due to this, the backups are associated with the Subscription and not the Resource Group or Server.
A common issue is that the users with permissions at Resource Group level or Resource level will not be able to see the backups.
The user need some read permissions at Subscription level to be able to see the backups.

When it's not possible to assign permissions at Subscription level or we wish to keep the users with as least privileges as possible, the subscription administrator can create a custom role with just that read permissions and assign it to the users/groups that should see the LTR backups.

Please replace {SubscriptionId} and {user@company.com} accordingly.

#Login to Azure
Login-AzureRmAccount

#List the subscriptions you have access
Get-AzureRmSubscription

#Select the subscription you want to use in case you have access to more than one subscription
Select-AzureRmSubscription -Subscription "{SubscriptionId}"

#Create the custom role
$role = Get-AzureRmRoleDefinition "Reader"
$role.Id = $null
$role.Name = "Long Term Retention Backups - Read"
$role.Description = "Can view the Long Term Retention Backups."
$role.Actions.Clear()
$role.Actions.Add("Microsoft.Sql/locations/longTermRetentionBackups/read")
$role.Actions.Add("Microsoft.Sql/locations/longTermRetentionServers/longTermRetentionBackups/read")
$role.Actions.Add("Microsoft.Sql/locations/longTermRetentionServers/longTermRetentionDatabases/longTermRetentionBackups/read")
$role.AssignableScopes.Clear()
$role.AssignableScopes.Add("/subscriptions/<SubscriptionId>")
New-AzureRmRoleDefinition -Role $role

#List all the roles, confirm that the custome role is available, it can take some time
#Get-AzureRmRoleDefinition | FT Name, IsCustom

#Assign the role
New-AzureRmRoleAssignment -RoleDefinitionName "Long Term Retention Backups - Read" -SignInName "{user@company.com}" -Scope "/subscriptions/{SubscriptionId}" 

#Wait some seconds and the user should be able to see the backups now

Viewing latest article 3
Browse Latest Browse All 12366

Trending Articles