Configure custom Azure roles

Azure Role-Based Access Control (RBAC) is a model that allows organizations to manage who has access to Azure resources, what they can do with those resources, and what areas they have access to. While there are many built-in roles provided by Azure, there may be occasions when the predefined roles do not fit the exact needs of your organization. In such cases, custom roles can be created in Azure to provide a tailored set of permissions.

Understanding Custom Roles

Custom roles can have any combination of permissions associated with them, with the ability to fine-tune exactly what actions a user assigned the role is permitted to perform. These roles can be scoped at multiple levels, from a management group down to an individual resource.

Prerequisites for Creating Custom Roles

• Adequate permissions such as Owner or User Access Administrator on the subscription, resource group, or service to apply the custom role
• Understanding of Azure RBAC and the actions, not actions, and data actions for Azure resources

Creating Custom Roles in Azure

Before you can create a custom role, you should identify the set of actions you need to assign. Azure permissions are granular, and permissions can be specified to include actions (what actions can be performed), not actions (exclusions), data actions (for data operations), and not data actions.

Using the Azure Portal to Create a Custom Role

1. Navigate to the Azure portal.
2. Find the Azure Active Directory or subscription where you want to create the role.
3. Select “Access control (IAM)” and then click on “Add” and select “Add custom role”.
4. On the “Basics” tab, enter a name and description for the role.
5. On the “Permissions” tab, add the appropriate permissions by selecting from available actions, data actions, not actions, and not data actions.
6. On the “Assignable Scopes” tab, specify where this role can be assigned.
7. Review and create the custom role.

Using Azure PowerShell to Create a Custom Role

$role = @{
Name = “Custom Role”
Id = “Unique GUID”
IsCustom = $true
Description = “Custom role description”
Actions = @(
“Microsoft.Resources/subscriptions/resourceGroups/read”,
“Microsoft.Insights/alertRules/*”
)
NotActions = @(
“Microsoft.Resources/subscriptions/resourceGroups/write”
)
AssignableScopes = @(
“/subscriptions/your_subscription_id”
)
}
New-AzRoleDefinition @role

Using Azure CLI to Create a Custom Role

az role definition create –role-definition ‘{
“Name”: “Custom Role”,
“Description”: “Custom role description”,
“Actions”: [
“Microsoft.Resources/subscriptions/resourceGroups/read”,
“Microsoft.Insights/alertRules/*”
],
“NotActions”: [
“Microsoft.Resources/subscriptions/resourceGroups/write”
],
“AssignableScopes”: [
“/subscriptions/your_subscription_id”
]
}’

Comparing Custom Roles with Built-in Roles

Custom roles offer a greater flexibility over built-in roles by allowing you to create unique permission sets tailored to your organization’s needs. Built-in roles, on the other hand, offer a quick and easy way to assign common sets of permissions that cater to most standard roles within Azure.

Best Practices

• Reuse built-in roles whenever possible to reduce management complexity
• Limit custom roles to only the permissions necessary for users to perform their jobs
• Regularly review and audit custom roles to ensure they are up-to-date with the principle of least privilege
• Use descriptive names and descriptions for custom roles to clearly identify their purpose

Conclusion

Custom Azure roles play an important role in fine-tuning access controls and ensuring that the principles of least privilege are followed within an Azure environment. By understanding how to create and manage custom roles, organizations can ensure that users only have the access they need to perform their functions, which is an essential aspect of Azure security and compliance, especially for candidates studying for the SC-300 Microsoft Identity and Access Administrator exam.