Azure Role-Based Access Control Deep Dive

In this video we walk through Azure Role-Based Access Control including custom roles, PIM, locks and more.

[@grahamwilton]

high-quality training with actual context and things the documents don't tell you - so much more than just another how to video

[@NTFAQGuy]

Thanks, glad it's useful.

[@madhurdeepak2881]

Another amazing video John !! Love the way you explain these topics. Thank you again.

[@jeffreyhines780]

Great video! It really helped me to understand how RBAC and PIM work together

[@kenrq63]

Some more very good information regarding Azure resources, thank you John.

[@NTFAQGuy]

My pleasure! Ken, you based in the US?

[@lltagged]

This video helped me to understand RBAC a whole lot better to solve some challenges and problems we have. Got some more digging to do! 🤣🤣 Thanks John!

[@NEILBAAL]

Superb as always John

[@NTFAQGuy]

Thank you!

[@ansariwn]

Great tutorial, very informative. Thank you.

[@NTFAQGuy]

Glad it was helpful!

[@deychand11]

Super like the content John. Thanks.

[@NTFAQGuy]

Glad you enjoyed it

[@Cuoc_song_My4]

Amazing teacher

[@janbergersen2498]

Great video! Thanks!

[@NTFAQGuy]

Thanks

[@rickydiaz4471]

You won one more subscriber, thanks.

[@NTFAQGuy]

Thanks!

[@rbattle2u]

Superb

[@amsirajuddin]

nice one!

[@laxminarayanarora4670]

Superb !

[@NTFAQGuy]

Thank you

[@dineshsengar390]

hi John, I have a "contributor" role assigned at subscription and "User" role in AAD to which subscription is associated with. I tried creating a Azure AD B2C tenant but access was denied with below message: "User Authorization: Access is denied. You must have one of the following user roles for access: External ID User Flow Administrator, External ID User Flow Attribute Administrator, B2C IEF Keyset Administrator, B2C IEF Policy Administrator, External Identity Provider Administrator, Application Administrator, Security Administrator, Security Reader, Global Reader, Global Administrator." Since, i have contributor role at subscription, i assumed that i can spin up any resource in the subscription. Does this not apply on B2C ? and do i need to change my role in Active Directory ?

[@NTFAQGuy]

AAD does not live in a subscription. Subscriptions USE AAD instances. Your contributor role is only at a subscription and therefore has no impact at AAD levels. You need a role set at AAD which is one of those it lists.

[@dineshsengar390]

@@NTFAQGuy Thanks John

[@MySasasasasasasasas]

gracias!

[@NTFAQGuy]

You are welcome. Thanks for watching.

[@pokmnhyu]

Hi John, Great video again. I am trying to figure out what are the exact permission required if I would like my Azure applications to rotate the passwords of my Global administrators every few months ? The idea is whenever global admin has to use the password, it will have to draw from some sort of external vault.

[@NTFAQGuy]

That would be an azure ad permission not an azure permission.

[@pokmnhyu]

@@NTFAQGuy yes john. Sorry for asking question on the wrong video. I was trying to look at azure ad built-in role but unable to figure out the exact role which can suffice the purpose.

[@pallabkolkata]

@John Savill Where do i put the custom JSON file after i create it, could you please let me know, where to place it and use it

[@NTFAQGuy]

Does not matter where you put it. Once you import to create the new role the JSON file can be deleted.

[@pankajpandey5063]

Hi Please make video on WVD deep dive

[@AleksandarIvanov69]

For the algorithm! 😁

[@robdeep19]

Great video as always! Is there anyway to automate the assignment an RBAC role to a group? I understand a group with "isAssignableToRole" property set to true cannot be of dynamic membership type. Does that mean if I need to assign the "Guest Inviter" role to a large group of people, they would have to activate it via PIM or I would have to explicitly assign the role to each user?

[@ibmuser13]

great content, John! liked and subscribed. I was also wondering if you could help with a use case, I want to write an azure policy because I dont want the Owner role to be able to cancel or transfer subscriptions, would you be able to help me with that? thanks!

[@NTFAQGuy]

Owner of a sub will be able to move it. Limit who is owner.

[@ibmuser13]

@@NTFAQGuy understood. The point being, we dont want the Owners to be able to cancel the subscription or move them to another mgmt group. They can do everything else that the role allows. So I wanted to write an azure policy and apply it to the mgmt groups

[@NTFAQGuy]

@@ibmuser13 I’ve never tried that. You would need to look if that’s possible based on properties exposed. My gut feeling is no