Roles to be requested for a security assessment

ABITBOL Ilan 1 Reputation point
2021-04-06T15:40:51.79+00:00

I'm trying to figure out the exact privileges to ask for when a customer needs to create an account on their Azure AD tenant during a security audit.
I have identified the roles:

  • "Security Reader" which allows access to the CSA ;
  • "Global Reader" which allows to read the administration information.

But this doesn't seem to be enough, if I want to access the user password policies is a less privileged role than the "Authentication Policy Administrator" role usable?
Concerning the access to the keys, secrets and certificates definitions of the Vault in order to see for example if expiration is in place, I have identified the roles "Key Vault Reader" and "Key Vault Secrets User".
Finally for the storage accounts, which role allows to read everything without being able to modify or assign roles?

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
711 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee
    2021-04-19T20:48:05.237+00:00

    @ABITBOL Ilan
    Thank you for your post and I apologize for the delayed response!

    If I want to access the user password policies is a less privileged role than the "Authentication Policy Administrator" role usable?

    • Based off our documentation, it looks like the Authentication Policy Administrator, would be the least privileged role to manage auth method and password protection policies.

    For the storage accounts, which role allows to read everything without being able to modify or assign roles?

    If the built-in AzureAD and RBAC roles don't meet your specific needs, I'd also recommend looking into creating custom roles.
    Create or update Azure custom roles using the Azure portal
    Create and assign a custom role in Azure Active Directory

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    0 comments