Create custom role-based access control (RBAC) and Azure AD roles

Role-Based Access Control (RBAC) is a method of regulating access to resources based on the roles of individual users within an organization. RBAC ensures that only authenticated users are given permission to access certain resources or perform specific tasks. Azure Active Directory (Azure AD) roles are a critical component in managing and securing your Azure environment, particularly when preparing for the AZ-104 Microsoft Azure Administrator exam.

Understanding Azure RBAC

Azure RBAC provides fine-grained access management to Azure resources, allowing you to segregate duties within your team and grant only the amount of access necessary to users to perform their jobs. Instead of giving everybody unrestricted permissions in your Azure subscription or resources, you can allocate permissions based on the needs of a particular job.

Key Concepts of Azure RBAC

• Roles: A set of permissions that allows users to perform specific actions, such as read, write, or delete.
• Scope: The set of resources that the access applies to. Scope can be set at multiple levels: management group, subscription, resource group, and resource.

Pre-defined Azure RBAC Roles

Azure comes with several built-in roles that you can assign to users, groups, service principals, and managed identities. Here are a few example roles:

• Owner: Has full management access, including the right to delegate access to other users.
• Contributor: Can create and manage all types of Azure resources but cannot grant access to others.
• Reader: Can view existing Azure resources.
• User Access Administrator: Can manage user access to Azure resources.

Custom Roles

While pre-defined roles should meet most of your organizational requirements, there may be situations where you need a more tailored set of permissions. This is where custom roles come into play.

To create custom roles, you can either start from scratch or clone an existing role and modify the permissions. Custom roles can be created using the Azure portal, Azure PowerShell, Azure CLI, or the REST API.

Here is an example of creating a custom role with Azure CLI:

az role definition create –role-definition ‘{
“Name”: “Custom Virtual Machine Operator”,
“Description”: “Perform actions on virtual machines”,
“Actions”: [
“Microsoft.Compute/virtualMachines/start/action”,
“Microsoft.Compute/virtualMachines/restart/action”
],
“AssignableScopes”: [“/subscriptions/your-subscription-id”]
}’

In this example, a custom role named “Custom Virtual Machine Operator” is created which allows the user to start and restart virtual machines in the specified subscription.

Azure AD Roles

Azure AD roles are different from Azure RBAC roles and are used for managing access to Azure AD resources. While Azure RBAC roles control permissions within Azure services, Azure AD roles are primarily used to manage Azure AD and other Microsoft services like Microsoft 365.

Key Concepts of Azure AD Roles

• Role Assignments: Assigning roles to users, groups, or service principals.
• Directory Roles: Set of permissions that are used to manage Azure AD and other Microsoft services.

Examples of Azure AD Roles

• Global Administrator: Has access to all administrative features in Azure AD.
• User Administrator: Can create and manage users and groups, assign roles in Azure AD.
• Compliance Administrator: Can manage compliance-related features in Microsoft 365.

Combining Azure RBAC and Azure AD Roles

It’s important to understand the distinction between these two sets of roles and how they complement each other. An Azure Administrator must use both sets of roles to effectively manage access to Azure resources and Azure AD functionality.

Best Practices for Assigning Roles

When assigning roles in Azure:

1. Follow the Principle of Least Privilege: Assign users only the permissions they need to do their jobs.
2. Regularly Review Access: Periodically review roles and access permissions to make sure they are still relevant.
3. Audit Role Assignments: Use Azure’s activity logs to audit role assignments and ensure compliance.

In summary, Azure RBAC and Azure AD roles are essential tools for any Azure Administrator, especially for those preparing for the AZ-104 exam. They help secure and manage the resources within Azure and Azure AD by providing precise control over who can do what. Understanding the difference between Azure RBAC and Azure AD roles, how to create and assign custom roles, and following best practices are key to maintaining a secure and efficient Azure environment.