Enable Azure role based access control RBAC

Azure Role-Based Access Control (RBAC) is a robust authorization system that manages permissions within your Azure environment. It governs who has access to your resources, what actions they can perform, and at what scope these rights apply. In this lesson, you will learn about RBAC’s core concepts, see how to assign roles using the Azure portal, and create custom roles tailored to your organization’s needs.

Key RBAC Concepts

Azure RBAC is built around three fundamental components:

• Who: The security principal—this can be a user, group, service principal, or managed identity requesting access.
• What: The permitted actions defined in a role definition. These are expressed in JSON and enumerate what operations a role can perform.
• Where: The scope at which the permissions apply, such as a subscription, resource group, or an individual resource.

When a role definition is assigned to a security principal at a given scope, a role assignment is created. The diagram below illustrates the relationship between these components:

Understanding Role Definitions

A role definition specifies the permissions a role confers. Azure offers several built-in roles such as Owner, Reader, and Contributor, though you can create custom roles to suit specific requirements.

For example, the Contributor role definition is represented by the following JSON:

{
    "Name": "Contributor",
    "Id": "b24988ac-6180-42a0-ab88-20f7382dd24c",
    "IsCustom": false,
    "Description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
    "Actions": [
        "*"
    ],
    "NotActions": [
        "Microsoft.Authorization/*/Delete",
        "Microsoft.Authorization/*/Write",
        "Microsoft.Authorization/elevateAccess/Action",
        "Microsoft.Blueprint/blueprintAssignments/write",
        "Microsoft.Blueprint/blueprintAssignments/delete",
        "Microsoft.Compute/galleries/share/action"
    ],
    "DataActions": [],
    "NotDataActions": [],
    "AssignableScopes": [
        "/"
    ]
}

This JSON snippet defines the Contributor role to allow full resource management with some exceptions (e.g., role assignments, blueprint modifications, and sharing image galleries). The asterisk (*) in the "Actions" array denotes complete access, whereas the "NotActions" section lists specific restrictions.

Built-In Roles Overview

Azure's key built-in roles include:

• Owner: Grants full control over all resources, including the ability to delegate access.
• Contributor: Allows management of resources but does not grant permissions to assign roles.
• Reader: Provides read-only access, blocking modifications and access to sensitive details like keys or connection strings.
• User Access Administrator: Permits managing user access without altering the resources directly.

The following diagram visually represents these built-in roles and their respective access permissions:

Assigning Roles Using the Azure Portal

The next steps guide you through assigning roles with the Azure portal.

Creating a Resource Group

1. Log in to the Azure portal and navigate to the resource groups section.
2. Create a new resource group if needed; for example, name it "AC demo RBAC" in the East Europe region.

After creation, the resource group appears in your list:

Using the Access Control (IAM) Blade

To manage permissions, open the Access Control (IAM) blade for your resource group. In this pane, you can:

• Review current role assignments.
• Inspect access details for different users.
• Add new role assignments.

Role assignments can be inherited from a higher-level scope. For example, an assignment at the subscription level might be reflected within a specific resource group.

For example, you might see that your account is designated as an owner at the subscription level:

Adding a Role Assignment

To assign a role such as Reader:

1. Click “Add role assignment.”
2. Choose the Reader role.
3. Select the members (users or groups) to assign the role.
4. Confirm the assignment.

The user interface will display:

• The role definition, detailing the permissions.
• The members selected for this role.
• The scope where the assignment is applied.

After completing these steps, you can view the updated role assignments:

Creating a Virtual Network

To extend the example, let’s create a virtual network within the resource group:

1. Select the appropriate subscription and resource group.
2. Provide a name (e.g., "demo VNet") and configure the necessary settings.
3. Review the configuration and create the virtual network.

After clicking "Review + Create" and then "Create," the deployment begins:

Once active, navigate to the virtual network. The Access Control (IAM) pane will display any inherited role assignments.

Creating Custom Roles

Built-in roles might not always meet your requirements. In such cases, you can create custom roles to define permissions precisely.

1. In the Azure portal, select "Add custom role."
2. Provide a meaningful name (for example, "VM App Operator") and a detailed description.
3. Choose to start from scratch or clone an existing role. Starting from scratch allows you to select specific permissions.

For instance, to assign virtual machine-related permissions, filter for “Microsoft.Compute” and select actions such as:

• Read latest patch assessment operation details
• Get virtual machine log definitions
• Get virtual machine run commands
• Delete virtual machine run commands

After selecting the required permissions:

4. Click "Next" and then "Create" to finalize your custom role. Note that it might take a few minutes for the role to propagate throughout the portal.

Assigning the Custom Role

To assign your newly created custom role:

• Filter for custom roles during the role assignment process.
• Select your custom role (e.g., "CR-VM App Operator").
• Choose the desired members (users or groups, such as an HR group).
• Complete the role assignment.

After assignment, verify the updated permissions at the management group level:

Next Steps: Azure Policies

In the upcoming section, we will explore Azure Policies and compare them with RBAC. Azure Policies help enforce resource configurations and compliance requirements, complementing the access control provided by RBAC.

This concludes our lesson on enabling Role-Based Access Control in Azure. For further information, consider reviewing the following resources:

• Azure Role-Based Access Control Documentation
• Kubernetes Basics

Happy configuring!