[PowerShell] Grant-FinOpsHubBlobAccess

📝 Scenario

As a hub admin, I need to grant users access to blob storage in order to connect to Power BI reports

💎 Solution

Create an Grant-FinOpsHubBlobAccess command that assigns access to read/update storage blob data.

Synopsis

Grants storage blob access to a user, group, or service principal.

Syntax

# Grant access to an object ID
Grant-FinOpsHubBlobAccess `
    [-HubName] <string> `
    [-ResourceGroupName <string>] `
    -ObjectId <string> `
    [-Access <string>]

# Grant access via an email address lookup
Grant-FinOpsHubBlobAccess `
    [-HubName] <string> `
    [-ResourceGroupName <string>] `
    -Mail <string> `
    [-Access <string>]

# Grant access to the current user
Grant-FinOpsHubBlobAccess `
    [-HubName] <string> `
    [-ResourceGroupName <string>] `
    -CurrentUser `
    [-Access <string>]

Description

The Grant-FinOpsHubBlobAccess command grants the specified user, group, or service principal access to the storage account in the hub instance. Access is only granted using the built-in Storage Blob Data roles.

Parameters

ℹ️ Additional info

Each -Access value maps to the corresponding storage blob data role:

• Storage Blob Data Reader
• Storage Blob Data Contributor
• Storage Blob Data Owner

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Do you feel this is needed given it's a fairly standard RBAC operation (albeit hard to discover)?
3. Do we need an -ObjectType parameter? Description: "Indicates the type of the object ID specified. Allowed values: User, Group, ServicePrincipal. Default: User."
4. Leave comments to help us solidify the vision.

Start from the proposed Grant-FinOpsHubBlobAccess command syntax and parameter descriptions. Resolve the open questions about object types and the required RBAC behavior, then implement the ObjectId, Mail, and CurrentUser paths with Reader, Contributor, and Owner mappings. Done means the command grants the selected built-in Storage Blob Data role for each supported target.