azure:azure_iam [Core Dump]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Azure IAM ======

  * [[Microsoft Entra]]
  * [[microsoft:Privileged Access Management]]

  * //AzureAD// vs. //AzureRM// roles

  * //Entities// that can be granted access to resources in Azure are generally called //security principals//. This includes users, groups, service principles and managed identities.
  * [[azure:Authentication and Authorization]]
  * [[azure:az-500:alt:application_management|Application Management]]
  * [[https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task|Least privileged role for certain tasks]]
  * [[azure:Lighthouse]]
  * [[https://docs.azure.cn/en-us/entra/identity/role-based-access-control/best-practices|Entra Role Best Practices]]

====== Azure Administrator Roles (Entra ID Roles) vs. Azure Roles (Azure RBAC Roles) ======
  * Entra roles/directory (scope) roles, administrator roles
  * Azure roles, Azure RBAC roles, Azure resource roles
  * There are some built-in roles for Entra ID and Azure that have the same name, for example, //Reader// and //Security Reader//.

====== Tenant/Root Managment Group Level Access ======
  * As a Global Admin you may need to enable the option to grant yourself access to management groups/subscriptions in your tenant. Under the tenant //Properties// screen there is an option (toggle) for this. It allows the user to manage access to all Azure subscriptions and management groups in the tenant.
    * This setting adds the role //User Access Administrator// to the root //Management Group//, which lets you manage user access to Azure resources.
    * ☝️This setting is for special use cases. Most access to resources is controlled by RBAC and assigning specific roles to certain scopes.
    * This is referred to as //elevated access//.
    * [[https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal#how-does-elevated-access-work]]

>  Microsoft Entra ID and Azure resources are secured independently from one another. That is, Microsoft Entra role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Microsoft Entra ID. However, if you are a Global Administrator in Microsoft Entra ID, you can assign yourself access to all Azure subscriptions and management groups in your directory. Use this capability if you don't have access to Azure subscription resources, such as virtual machines or storage accounts, and you want to use your Global Administrator privilege to gain access to those resources.


===== RBAC/Roles =====
  * Instead of assigning individual rights to a security principle //role-based access control (RBAC)// is used to assign rights to a role and then assign roles to users. This level of indirection is more manageable.
  * In Azure there are two general types of roles, Azure AD roles and RBAC roles.

  * [[https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference|Azure AD Build-in Roles]]
  * [[https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles|Azure Built-in Roles]]

  * To assign a user, group or service principle a role the scope is specified. The scope can be at the level of Management Group, Subscription, Resource Group, or Resource.
{{:azure:scope-levels.png|}}
  * Control plane actions can have a Management Group scope, but data plane actions cannot. Data plan actions can be at the subscription level.
  * Example of a control plane action is, ''Microsoft.Storage/storageAccounts/listKeys/action''.
  * Example of a data plane action is, ''Microsoft.KeyVault/vaults/keys/get/action''

====== Service Accounts ======
Microsoft’s guidance is to avoid using regular user accounts as service accounts when possible. Instead:
  * Use App Registrations + Service Principals with client secret or certificate auth.
  * Use Managed Identities if the service runs in Azure, so you don’t manage credentials at all.

====== Security Principles ======
  * user
  * group
  * Service Principle
  * Managed Identity

====== Managed Identity ======

  * Use case, [[https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad]]
  * What is //system managed// vs. //user managed//?


====== Read-only Access ======
The following roles/permissions are good for doing security assessments.

  * //Reader//
  * //Reader and Data Access//, allows access to storage account keys, which provides access to various bits of configuration and the contents of the containers.
  * ''Microsoft.Network/networkInterfaces/effectiveRouteTable/action'', this permission allows the effective routes for a NIC to be listed


====== Conditional Access ======
  * [[https://github.com/aollivierre/ConditionalAccess]], Baseline Conditional Access Policies

====== To Explore ======
  * [[https://www.azadvertizer.net/]]
  * [[https://idpowertoys.merill.net/]], Conditional Access Policy Visualizer

====== Roles ======
  * //User Access Administrator//

From CIS Azure Foundations Benchmark:

>The User Access Administrator role grants the ability to view all resources and manage access assignments at any subscription or management group level within the tenant. Due to its high privilege level, this role assignment should be removed immediately after completing the necessary changes at the root scope to minimize security risks.

====== Working With Roles ======

Get the Azure Roles assigned to a user.
<code>
Get-AzRoleAssignment -SigninName "Michael.Gupton@xyz.org" | select RoleDefinitionName, Scope
</code>

<code>
az role assignment list --assignee "Michael.Gupton@xyz.org"
</code>

=== Get Roles that have a permission ===

<code>
Get-AzRoleDefinition | Where-Object {
    $_.Actions -match "Microsoft.Authorization/policyAssignments"
}
</code>
====== Related ======
  * [[azure:service_principles|Service Principles]]
  * [[azure:Authentication and Authorization Examples]]