Azure 数据工厂 - 只读自定义角色

Question

我们希望为支持人员提供对 Azure 数据工厂的只读访问权限，以便他们能够解决问题。正在关注this guide我能够创建一个自定义角色，该角色主要可以解决问题，但经过进一步审查，我可以看到授予此角色的用户仍然可以添加/删除/保存管道，这对我们来说是禁忌。这里有什么建议吗？下面的模板是我们使用的:

{
  "Name": "MGB Data Factory Reader",
  "Id": "88888888-8888-8888-8888-888888888888",
  "IsCustom": true,
  "Description": "Read Only Access to Data Factories ",
  "Actions": [
    "Microsoft.DataFactory/datafactories/read",
    "Microsoft.DataFactory/datafactories/activitywindows/read",
    "Microsoft.DataFactory/datafactories/providers/Microsoft.Insights/diagnosticSettings/read",
    "Microsoft.DataFactory/datafactories/providers/Microsoft.Insights/metricDefinitions/read",
    "Microsoft.DataFactory/datafactories/datasets/read",
    "Microsoft.DataFactory/datafactories/datasets/activitywindows/read",
    "Microsoft.DataFactory/datafactories/datasets/sliceruns/read",
    "Microsoft.DataFactory/datafactories/datasets/slices/read",
    "Microsoft.DataFactory/datafactories/tables/read",
    "Microsoft.DataFactory/datafactories/gateways/read",
    "Microsoft.DataFactory/datafactories/linkedServices/read",
    "Microsoft.DataFactory/datafactories/datapipelines/read",
    "Microsoft.DataFactory/datafactories/datapipelines/activities/activitywindows/read",
    "Microsoft.DataFactory/datafactories/datapipelines/activitywindows/read",
    "Microsoft.DataFactory/datafactories/runs/loginfo/read",
    "Microsoft.DataFactory/factories/read",
    "Microsoft.DataFactory/factories/adfcdcs/read",
    "Microsoft.DataFactory/factories/adflinkconnections/read",
    "Microsoft.DataFactory/factories/getDataPlaneAccess/read",
    "Microsoft.DataFactory/factories/getFeatureValue/read",
    "Microsoft.DataFactory/factories/operationResults/read",
    "Microsoft.DataFactory/factories/pipelineruns/read",
    "Microsoft.DataFactory/factories/pipelineruns/activityruns/read",
    "Microsoft.DataFactory/factories/pipelineruns/queryactivityruns/read",
    "Microsoft.DataFactory/factories/providers/Microsoft.Insights/diagnosticSettings/read",
    "Microsoft.DataFactory/factories/providers/Microsoft.Insights/metricDefinitions/read",
    "Microsoft.DataFactory/factories/queryFeaturesValue/read",
    "Microsoft.DataFactory/factories/querypipelineruns/read",
    "Microsoft.DataFactory/factories/querytriggerruns/read",
    "Microsoft.DataFactory/factories/triggerruns/read",
    "Microsoft.DataFactory/factories/dataflows/read",
    "Microsoft.DataFactory/factories/dataMappers/read",
    "Microsoft.DataFactory/factories/datasets/read",
    "Microsoft.DataFactory/factories/sandboxpipelineruns/read",
    "Microsoft.DataFactory/factories/sandboxpipelineruns/sandboxActivityRuns/read",
    "Microsoft.DataFactory/factories/globalParameters/read",
    "Microsoft.DataFactory/factories/integrationruntimes/read",
    "Microsoft.DataFactory/factories/integrationruntimes/getstatus/read",
    "Microsoft.DataFactory/factories/integrationruntimes/monitoringdata/read",
    "Microsoft.DataFactory/factories/integrationruntimes/nodes/read",
    "Microsoft.DataFactory/factories/integrationruntimes/outboundNetworkDependenciesEndpoints/read",
    "Microsoft.DataFactory/factories/linkedServices/read",
    "Microsoft.DataFactory/factories/managedVirtualNetworks/read",
    "Microsoft.DataFactory/factories/managedVirtualNetworks/managedPrivateEndpoints/read",
    "Microsoft.DataFactory/factories/privateEndpointConnectionProxies/read",
    "Microsoft.DataFactory/factories/privateEndpointConnectionProxies/operationresults/read",
    "Microsoft.DataFactory/factories/privateEndpointConnectionProxies/operationstatuses/read",
    "Microsoft.DataFactory/factories/privateEndpointConnections/read",
    "Microsoft.DataFactory/factories/privateLinkResources/read",
    "Microsoft.DataFactory/factories/pipelines/read",
    "Microsoft.DataFactory/factories/pipelines/pipelineruns/read",
    "Microsoft.DataFactory/factories/pipelines/pipelineruns/activityruns/progress/read",
    "Microsoft.DataFactory/factories/providers/Microsoft.Insights/logDefinitions/read",
    "Microsoft.DataFactory/factories/triggers/read",
    "Microsoft.DataFactory/factories/triggers/triggerruns/read",
    "Microsoft.DataFactory/locations/getFeatureValue/read",
    "Microsoft.DataFactory/checkazuredatafactorynameavailability/read",
    "Microsoft.DataFactory/operations/read"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/{subscriptionId1}",
    "/subscriptions/{subscriptionId2}",
    "/providers/Microsoft.Management/managementGroups/{groupId1}"
  ]
}

Answer 1

为什么不为用户提供数据工厂资源上的内置读取者角色。为什么创建自定义角色