<# CompanyName : Magnascale Requirements : Azure CloudShell Copyright : (c) 2025. All rights reserved .Description The following code will take a user provided resource group and allow Event Hub Manager to use the Storage Accounts and right-size the Even Hubs in your environment The Event Hub Manager is assigned Blob Data Contributor and Storage Account Contributor on the specific storage accounts defined during deploymentoyment. .Usage Edit the resourcegroup parameter to the resource group name where the application is deployed and then copy paste the code into your cloud shell. Ensure you have permission to create custom roles and perform role assignments. #> #Specify the managed resource group name here, for example: #"mresourcegroup-eventhub-manager-20220817194906" $resourcegroup = "mrg-eventhub-manager-internal-preview-20250609193333" #This section performs the role assignment on the specified storage accounts $deployment = Get-AzResourceGroupDeployment -ResourceGroupName $resourcegroup $configsa= $deployment.Parameters.storageAccountName_config.Value.id.tostring() $logssa= $deployment.Parameters.storageAccountName_lr.Value.id.tostring() $blobrole = get-azroledefinition -name "Storage Blob Data Contributor" $sarole = Get-AzRoleDefinition -name "Storage Account Contributor" $applicationName= $deployment.Parameters.appName.Value $webapp = get-azresource -ResourceGroupName $resourcegroup -name $applicationname -resourcetype "Microsoft.Web/sites" New-AzRoleAssignment -Objectid $webapp.Identity.PrincipalId -roledefinitionname $blobrole.name -scope $logssa New-AzRoleAssignment -Objectid $webapp.Identity.PrincipalId -roledefinitionname $sarole.name -scope $logssa New-AzRoleAssignment -Objectid $webapp.Identity.PrincipalId -roledefinitionname $blobrole.name -scope $configsa New-AzRoleAssignment -Objectid $webapp.Identity.PrincipalId -roledefinitionname $sarole.name -scope $configsa #This section of code will create a custom role that has the minimum access required to #right size your Event Hub Namespaces $subscriptionscope=@() $subscriptions = get-azsubscription foreach ($s in $subscriptions) {set-azcontext $s.name ;$scope = Get-AzRoleAssignment| Where-Object { $_.RoleDefinitionName -eq "Owner" -or $_.RoleDefinitionName -eq "User Access Administrator" } $subscriptionscope +=$scope} $subscriptionscope = $subscriptionscope | where-object RoleAssignmentid -match "\/(subscriptions)\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/(providers)" $eventhubmanager = get-azroledefinition -name reader $eventhubmanager.name = "Event Hub Manager" $eventhubmanager.id = $null $eventhubmanager.iscustom = "True" $eventhubmanager.Description = "Custom Role used to right size Eventhub Namespaces" $eventhubmanager.Actions.clear() $eventhubmanager.Actions.add("Microsoft.EventHub/namespaces/write") $eventhubmanager.AssignableScopes.clear() foreach ($r in $subscriptionscope) {$eventhubmanager.AssignableScopes.add($r.scope)} new-AzRoleDefinition -role $eventhubmanager #This section will assign the above custom role and the standard Monitoring Reader role to all #the subscriptions you have owner access on so that Event Hub Manager can work on these #subscriptions. You can choose to not run this section and assign the 2 roles manually on #the subscriptions where you have Event Hubs. foreach ($sub in $subscriptionscope) { New-AzRoleAssignment -Objectid $webapp.Identity.PrincipalId -roledefinitionname $eventhubmanager.name -scope $sub.scope New-AzRoleAssignment -Objectid $webapp.Identity.PrincipalId -roledefinitionname "Monitoring Reader" -scope $sub.scope }