Manage API permissions to Azure subscriptions and resources

At the heart of managing API permissions is Role-Based Access Control (RBAC). RBAC provides fine-grained access management for Azure. Permissions are assigned through roles, which define what actions a user, group, or service can perform on a resource.

RBAC includes several built-in roles:

• Owner: Has full access to all resources, including the right to delegate access to others.
• Contributor: Can create and manage all types of Azure resources, but can’t grant access to others.
• Reader: Can view existing Azure resources.
• User Access Administrator: Can manage user access to Azure resources.

Additional roles are available and custom roles can be created for specific needs.

Example Scenario

Let’s say you have a team responsible for managing virtual machines in a specific subscription. You would:

1. Assign the ‘Virtual Machine Contributor’ role to the group at the subscription level.
2. This allows them to create, manage, and delete virtual machines, but not to alter access to these resources.

Managed Identities

For applications that need to access or modify resources, Azure provides Managed Identities. These identities allow you to authenticate to any service that supports Azure AD authentication without embedding credentials in your code.

There are two types of Managed Identities:

• System-assigned: Tied directly to a specific Azure service instance. When the service instance is deleted, the identity is deleted too.
• User-assigned: A standalone Azure resource that can be assigned to one or more Azure service instances.

Example of Managed Identity

An Azure Function needs to read from a storage account:

1. Create a system-assigned managed identity for the Azure Function.
2. Grant the managed identity ‘Storage Blob Data Reader’ role on the storage account.
3. The Azure Function can now read blobs without any credentials in the code.

Conditional Access

Conditional Access policies can help secure API access by applying the right access controls when needed. These policies can be based on certain conditions, such as the user’s role, location, or device state.

Example of Conditional Access

You want to ensure that only users from your corporate network can manage resources:

1. Create a Conditional Access policy that requires users to be located in the corporate network IP range to access Azure management APIs.
2. Assign this policy to the necessary roles or users.

Azure AD Privileged Identity Management (PIM)

Azure AD PIM enhances security by managing, controlling, and monitoring access within Azure AD, Azure, and other Microsoft Online Services. It introduces the concept of ‘just-in-time’ access.

Example of PIM

For a critical role such as the ‘User Access Administrator’, rather than giving permanent access:

1. You configure PIM to require users to request access when they need it.
2. Access can be time-bound and require approval.

Subscription and Resource Group Level Permissions

Permissions can be granted at different levels in Azure hierarchy:

Example of Scope-Based Assignment

For a user who needs read-only access to network resources in a single resource group:

1. Assign the ‘Network Reader’ role to the user at the specific Resource Group level.

Security Best Practices for API Permissions

• Follow the principle of least privilege; give users only the access they need.
• Regularly review and audit permissions and adjust them as necessary.
• Use groups for resource access where possible, rather than individual user accounts.
• Incorporate automation where possible to manage roles and access, like using Azure Policy or scripting with Azure CLI or PowerShell.
• Integrate with Azure AD Conditional Access to enforce multi-factor authentication (MFA) for sensitive operations.

Managing API permissions to Azure subscriptions and resources is crucial to maintain a robust security posture. Utilizing RBAC, Managed Identities, Conditional Access, and PIM provides you with a comprehensive set of tools to effectively control and monitor access to your Azure environment, an essential skill for the AZ-500 Microsoft Azure Security Technologies exam.