Chapter 4: Managing User Authorization

In the previous chapter, we covered how users are authenticated in solutions; this is the act of proving who you are. Once they have access, you must continually ensure that authenticated users can only access what they should – this is known as authorization.

At its simplest, some users may need administrative access to do everything within the Azure portal. In contrast, some users may only want to be able to read or view a specific resource.

In reality, you will have a vast mix of requirements everywhere between those two extremes – and of course, it's not just access to the Azure portal you will want to control, but all the apps and services you created in it.

In this chapter, we will examine how access control is performed using Active Directory (AD) roles and Azure roles.

Then, we'll look at how to manage the flow of access, using AD groups, management groups, subscriptions, and resource groups.

We'll...

Technical requirements

This chapter requires internet access to the Azure portal and an Azure subscription:

https://portal.azure.com

Understanding Azure roles

There are three distinct ways of managing user access in Azure, classic roles, Azure roles, and Azure AD roles. Each controls a different aspect of the platform and is used in different ways. We will examine the three types, how they are different, and how you use them.

Classic roles

When Azure was first introduced, access to resources was controlled using just three roles, which are discussed in the following sections.

Account Administrator

Only one per Azure account. This role grants access to the Azure Account Center for managing all subscriptions within an account. When you sign up for your Azure account, you are granted this role, and it enables you to create, cancel, and manage billing for subscriptions. It also allows you to change the Service Administrator role.

Service Administrator

Only one per subscription. This role allows you to manage the services in your Azure subscription, including canceling it. It is also the only role that will...

Managing users with hierarchies

A core principle for any system should be Least Privileged Access – that is, only allow access to something if it is required. Or, to put it another way, don't just give every user full owner access to everything! If a user only needs to manage storage accounts, only provide access to storage accounts.

To help manage access, a strategy of how these roles can be applied must be considered and designed.

After all, if you have thousands of users, granting access to each user on a per resource type basis would be unmanageable!

Management groups, subscriptions, and resource groups

We can assign user access to the resources they need at different scopes – management groups, subscriptions, resource groups, or individual resources. As we can see in the following figure, the relationships between these scopes are hierarchical, and permissions or roles set at the highest management group scope flow down to the child levels:

Figure...

Controlling access with PIM

The traditional security model defines policies such as least privileged access, meaning you should always assign the least amount of rights to any one user. However, you still need to assign administrator rights to some users.

With PIM, you can control when and for how long those rights are granted. In other words, users have to request elevated access as they need it explicitly, and this access can then be time-boxed to be automatically removed after a defined period.

This way, even if an individual account were compromised, an attacker would still not have high levels of access.

Specifically, PIM can help you by doing the following:

• Providing just-in-time elevated access to Azure AD and resources
• Assigning accounts with time-boxed start and end dates/times
• Requiring an additional approval step for elevated access
• Enforcing MFA
• Requesting justification for why access is required
• You getting notified when privileged roles are granted...

Managing risk with Identity Protection

To further support security for users, Microsoft employs an AI-based system for monitoring risky sign-ins. Known as Identity Protection, it continually monitors your users for known and new vulnerabilities and patterns that might indicate a compromised account.

Identity Protection monitors for two specific types of risk – User risk and Sign-in risk.

User risk

User risk is the probability that a user's account has been compromised. A risk score is calculated based on Microsoft's internal and external threat intelligence systems, such as security researchers, Microsoft's security teams, and other trusted services.

These types of risks are calculated offline – that is, they are based on information obtained from the above sources.

An example of the kind of threat it looks for are leaked credentials – when cybercriminals compromise a user's details, they are often shared on the dark web and traded...

Summary

In this chapter, we have covered authorization in Azure and how to manage user access, and introduced tools that will help you scale your user base without it becoming unmanageable.

We have covered the different types of roles available – Classic, Azure, and Azure AD, what the differences are, and how to create custom roles. We then looked at how to use management groups, subscriptions, and resource groups to manage the assignment of roles and, in particular, how rights flow down through hierarchies.

Using PIM, we saw how you can manage and grant time-boxed access to roles and run regular reports to ensure that the least privileged principle is adhered to.

Finally, we looked at advanced tooling for detecting and responding to common threats using Identity Protection.

With what you have learned in this chapter, you can now decide on the best authorization and security options for your own solutions.

In the next chapter, we will learn another complementary set...

Exam solution

The solutions to the exam scenarios can be found at the end of this book.

Mega Corp is a global company with a head office in the US and satellite offices in Europe. They have separate IT teams for the US and Europe, responsible for their regions in general, but ultimately the US IT Team has overall accountability.

Each region has a Sales, Marketing, and HR department, and each has its own IT Champions who support them by having the ability to create and manage resources and assign rights to other users.

The company is risk-averse and therefore demands that administrative roles be granted on the least privileged principle. They are also looking at automation options for responding to any external threats to their user accounts.