How to give different permission to different Resource Group automatically based on some RG naming convention in Azure

sachin sangal 1 Reputation point
2021-02-22T13:53:51.987+00:00

Hi,

I am creating different Resource Group like (rg-dev-department, rg-test-department) in one subscription.

I want to give different permission to different users based on resource group name like contributor permission to DEV RG and reader permission to TEST RG automatically when i create new Resource group.

Thanks.

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
710 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee
    2021-02-23T22:23:13.237+00:00

    @sachin sangal
    Thank you for your post!

    Based off your explanation it sounds like you want to:

    • Give different users permissions based on the resource group name. For example, Contributor for Dev RG, and Reader for Test RG.
    • This should occur each time a new resource group is created.

    From my experience when it comes to automating this, if you're deploying your resource group via PowerShell you can potentially create the resource group first and add IAM permissions for users afterwards.

    For example: Create resource groups, New-AzRoleAssignment 

    New-AzResourceGroup -Name demoResourceGroup -Location westus  
New-AzRoleAssignment -ObjectId <String> -ResourceGroupName <String> -RoleDefinitionName <String>

    Another way to do this is to assign each user their respective AzureAD groups based off permissions needed.

    For example:
    Create the AzureAD Group and assign users
    71291-image.png

    Add the respective role assignment to the group via RBAC
    71301-image.png

    I hope this helps! If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.