Microsoft Azure AD Roles and Azure Roles Explained with Examples
Published: 2024-05-11 16:54:04

**Azure AD Roles** are used to manage access to Azure AD resources, whereas **Azure Roles** are used to manage access to Azure resources. The scope of Azure AD roles is at the tenant level, whereas the scope of Azure roles can be specified at multiple levels including management group, subscription, resource group, resource. Azure AD roles and application roles are not linked together3. Azure AD roles are more for controlling access to Azure resources and don't really apply to application specific roles.

## Azure Roles
 These are ways of controlling access to Azure resources and services. They are defined by a collection of permissions that can be performed, such as read, write, and delete. Azure has several built-in roles or you can create your own custom roles. Some examples of Azure roles are Azure Administrator, Azure Developer, Azure Solutions Architect, Azure DevOps Engineer, and Azure Data Engineer.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ktkfgafspnbokjr23pe0.jpeg)

## Azure AD
 This is an identity store in Azure. Here we can define users, groups, applications, and service principles. These users can authenticate onto Azure and they can access resources that are part of Azure subscription.
 
We can assign Azure AD roles to a user and these permissions are normally given to manage the various aspects of Azure AD.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/imt8g4133ss8zqv2n0bu.jpeg)

## Create users and Group in Azure and assign Users (Members) to the Group

To create a new Azure AD user, start by logging into your Azure Portal. Inside the portal, navigate to the Azure search and enter user. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ak961snlost1mu44jv4y.png)

Select the “Users” tab and click on “Create New User.”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l8c3sk7dml1xxrk52ioy.png)


Input the necessary user details and finalize by creating the user account. 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qun6tsijmr2w6p8qpas0.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nfflwr39bz12czrghfey.png)
 
Under Password unselect the autogenerate a password option it is easy to remember to give the password of your choice, scroll down to bottom leave rest options as default, and click Review + Create.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/huuvu4rjpb7qry2i6am1.png)
click on Create to finalize the process.

Once the user is created you will land on the below page where you can see the newly created user name, on refreshing, in the list of users. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ftkgzpepbsvzi1c9euzi.png)

_click on the new user to see the user details._

## How To Create Azure Groups - Administrative department

From the left-hand side of the Manage pane click on Groups or type group on the search bar.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s8s8lxw3aa19k8y75pjj.png)
__Select group

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4glc0x516l5vedskifjp.png)
__Click on New group

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tn9u274tsmlaqitag6j6.png)
Select Group type, Add Group Name, Group Description, Select Owners, and Select create to create a group. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zrym2lmt7xptljtpwd46.png)

## Add members to the Azure Active Directory group
__From here you can manage the group or also you can add members.

__Click on the Group to see its details

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z7mm8ss39t47tj5iki0i.png)
__Select members

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bjym6o7altnk446h6ok6.png)
__Click on Add members

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/25fit0586lws95oo3ng0.png)
check the users you want to add to the group and click on select.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mbzvchvdpkxtdu9lh99p.png)
__Now we can see the members of the group.
__Click on a members to see its details.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b9xhqjyckin80dwfrjj9.png)
__Click the Role assignments, on the left pane, to view the role assignments at this scope.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qod2x9gn9qcc0y1lcl51.png)
__Click on add assignments
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pe5ggqc3lyflpcs5pv6k.png)
__The Add role assignment page opens
__On the Role tab, select a role that you want to use.
__You can search for a role by name or by description. You can also filter roles by type and category.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/niqfyy7hxck4jw1v6y0v.png)
__Click on add to give the role to the user
**Steps to login the created Global Admin in into the Azure Portal with his new credentials**

__Click on your account on the top right and select "sign in with a different account" 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/umbpg0ggasq30r4t1zc2.png)
__enter the new user credentials

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zdjuhzn3ehqzgj3cze7a.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lkcftpsxrcunb81wzr8c.png)
__Click Sign In to continue
__update your password, 
If prompted to update your passwor
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cqyn56nquut2cj5un5zl.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/62862cozms80155psid6.png)
__Click Sign In to continue

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9fgcoc6c6xkutd0kabnd.png)

__Once signed into Azure follow the prosses describe above to onboard users as an administrator. 
__screen captures are as shown below;

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tgw7d1il613ls2z8unlr.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wxk1kmx6bz03yory0t7s.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lzdu7qzfijxw5fl76dt5.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9i9ww3100vb94gjdggw4.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bue8pfzrdvw79e9ru09a.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dbsrdnwu46a0liinrtlp.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0gg6gyhqtbq1boxyv0jt.png)

## **We can now see the new user added by the new admin manager**