Azure RBAC - A Sure way to Control Access in Azure
Tags: azurerbac, rolebasedaccesscontrol, roleassignment, securityprincipal
Published: 2023-05-26 07:54:33

Our blog today will be dedicated to how to control who access Azure resources, the level and type of access a user possesses. This is a very important function in using Cloud resources for the following reasons:
1)To manage usage of Azure resources
2)To ensure that only the needed resources for a particular 
  user's duties are accessed
3)It is a way to manage Operational Expenditure

Azure Role Based Access Control (RBAC) is an access control system created within Azure Resource Manager and allows for exact administration of permissions for Azure resources. To use RBAC to control access, Roles have to be assigned to individual users. These are permissions given to users based on their role within an organization. This approach to managing access is less prone to error than assigning permissions to users individually.
Role Assignment consists of three main elements. These are security principal, role definition, and scope.
**Security principal** refers to a user, group, service principal, or managed identity that is requesting access to Azure resources.
**Role definitions**  is a collection of permissions that can be assigned to a user. An example is the Virtual Machine Contributor role that allows a user to create and manage virtual machines
**Scope** is the set of resources that the permission given applies to. When a role is assigned, further restrictions can be done by defining a scope. For example, a Web contributor can be limited to only one resource group

Let's move on to see the reality of these on the Azure portal as we describe what is explained above but first we will create a user to whom we will assign a role.

**Step 1 - Create a User**     
Log in to Azure portal and search for Azure Active Directory  
       
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bpu9ay5thprl2h5c1lyx.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/drbfxurvz1zmids7mumj.png)
It will take you to a Default Directory. Click on Users


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u1uho8m2stt1bkix94hl.png)
Then click on New User


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wejxey7qjhi6nc4sfpsi.png)
Complete the Basics

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eud5ho2bnrw8vo8jiw0d.png)
I will use wumi for the User Principal name which will also be the display name


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dt5prb2kb05fatl6k6w7.png)
Click on Review and Create

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/22ttmoq2rrfagsv89mqj.png)
Then User wumi has been created


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j4y3jmjslssm9aoo93ka.png)

**Step 2 - Create a Resource group and Assign Role**
Go to Resource group on the Azure portal and click on create

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/48u320p1l6312vuucawp.png)
Complete the Basics and click on Review and Create

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/50ymqcto548q9fk9g574.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lde64z7jqx1fdso3ydwm.png)

I will name the Resource group MayWorkload2

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/usvyyadc7f0pmwqrqto3.png)
When Validation is passed, click on Create


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l85fkhk62pkggjiz2yz3.png)
On the Resource group MayWorkload2 click on Access Control (IAM)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/18w18ufcinr041bel5e2.png)
Click on Add and select Add Role Assignment from the dropdown menu


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dtz5hxdny6grephqrnun.png)
Click on Add

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wghwtnqjzw9v592w8fsc.png)
Under Job function roles, search for Virtual Machine Contributor, which is the role we want to assign to User wumi, and click on it


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aklw9h3mewwlj1mpucqa.png)
Click on Select members and type in Virtual Machine Contributor in the Description box

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yluhk8doftqauzd6bprz.png)
On top righthand side of the next page displayed,you will find a list of users already created.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3vb8j7ece5eobdp2v2hx.png)
Select the User we want to assign role to, that is wumi

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tpgg1ito11mbhlk03y7y.png)
Click on Select

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4wd62y500e4p3iqm2a2q.png)
Then click on Review and Assign

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ib3m5zsm865w3dmeyarg.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a4yz8osd317aa5yzu5hf.png)


Wumi have been assigned the role of a Virtual Machine Contributor as indicated in the image above. This access only allows the User to manage virtual machine but not to access them or virtual network or storage account they are connected to

**Step 3 -View the Activity log**

Now let us view the Activity Log. Go to Resource group 
MayWorkload2 and click on Activity log

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fkko1eknbtm51z9wh2kb.png)

Here, two activities are shown in the Activity log. Role Assignment and updating resource group. It also show details about the activities including status, time, date ,subscription and the identity of the user that initiated the activities

**Step 4 - Removing a Role Assignment**

This may become very necessary when the User whom a role is assigned has completed his task for the role or has change roles or has left the service of the company.
Come on, lets go and see how this will be done

Go to Resource group MayWorload2 and click on Access Control(IAM)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vbg5njs4tx3vtmy5mwg9.png)
Click on Remove

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iafcwdthbzl53bhlxz16.png)
A confirmation dialog box will pop up


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8v3juevitz08tdxehi1g.png)
Click on Yes

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nw6y852p0h8dgkpz26nn.png)
Check the Resource group again

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/szr9f9hf6j9ym8eudww3.png)


The role assignment has been removed!

Trust you find this useful. Please give a feedback