Is there a way to prevent external invited users from being in IAM roles on a subscription?

FrankM-482 21 Reputation points
2021-05-20T14:28:24.813+00:00

Looking to see if it's possible to prevent/block guest accounts from IAM roles on a subscription.

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
711 questions
0 comments
Accepted answer
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee
    2021-05-26T17:19:33.603+00:00

    @FrankM-482
    Thank for your time and patience throughout this issue!

    Deny meaning, it denies to everyone except the ones we want to have access to it?

    • Yes, you can create a Deny Assignment for all principals (all users, groups, service principals, and managed identities in an Azure AD directory). However, you can exclude some principals (i.e. certain users or groups) from this Deny assignment.

    It seems like a good idea for something which has limited access to begin with but sounds difficult to implement when there a lot of users and groups which have access?

    • When it comes to our RBAC best practices, to make role assignments more manageable, avoid assigning roles directly to users. Instead, assign roles to groups. Assigning roles to groups instead of users also helps minimize the number of role assignments.

    It sounds like you're suggesting RBAC in that owners or administrators should know what type of access they are granting (or not granting) which could include not adding "guest" accounts to an IAM role?

    • Yes. Users in an Owner/Admin role should follow our RBAC best practices documentation and only grant the access users need, rather than granting unneeded IAM roles to guest users.

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee
    2021-05-20T16:24:57.067+00:00

    @FrankM-482
    Thank you for your post!

    Similar to a role assignment within IAM, you can leverage the Deny assignment feature. This feature attaches a set of deny actions to a user, group, or service principal at a particular scope for the purpose of denying access. Deny assignments block users from performing specific Azure resource actions even if a role assignment grants them access.

    98391-image.png

    As of right now, Azure Blueprints and Azure managed apps are the only way that deny assignments can be created. You can't directly create your own deny assignments. For more information see Understand resource locking in Azure Blueprints.

    If this feature doesn't meet your requirements, I'd recommend providing feedback/creating a feature request within our User Voice forum so our engineering team can take a closer look into implementing this.

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.