Applies to: 
Kyvos Enterprise 
Kyvos Cloud (SaaS on AWS) Kyvos AWS Marketplace
Kyvos Azure Marketplace Kyvos GCP Marketplace Kyvos Single Node Installation (Kyvos SNI)
Note
This is not required if the Virtual Private Cloud (VPC) is newly created from the Kyvos-provided template.
Download the AzureCustomRole_DeploymentUser.json file from the Azure Installation Files folder and keep it handy.
Creating a custom role
Log in to the Azure portal.
Navigate to Virtual Network and click Properties on the navigation bar. Copy the Resource ID and paste it onto a notepad. You will need this for creating the custom role.
Navigate to the Network Security group and click Properties on the navigation bar. Copy the Resource ID and paste it onto a notepad. You will need this for creating the custom role.
Navigate to Resource Group and click Access Control (IAM) on the navigation bar.
Click Add > Add custom role as shown below.
Click the JSON tab, and then click Edit.
Delete the existing JSON text.
Copy the text from the AzureCustomRole_DeploymentUser.json file and paste it into the JSON textbox.
Replace the <Virtual Network Resource ID> and <Security Group Resource ID> with the respective Resource IDs that you copied earlier (in steps 2-3).
Click Save. The JSON automatically assigns the required permissions.
Now go to the Basics tab, and provide a unique name for your role.
Click on Review + Create. Then click Create.
Attach Role to User
Once you have created a custom role on Azure, you need to attach the role to the deployment user. For this, perform the following steps.
Go to the Network Security group and click Access Control (IAM).
Click Add > Add role assignment.
On the Role Assignment pane, enter details as:
Role: Search and select the custom role that you created (in the previous steps).
Assign Access To: Select the User, group, or service principal option.
Select: Select the User to which you want to add this role.
Click Review+Assign.
Navigate to Virtual Network, click Access Control (IAM) and then add the same Role and assign to the same USER that you used for the Network Security Group and click Save.