RBAC for AAD
The Azure teams have done an awesome job implementing RBAC. I would love to have this same functionality (granular permissions + custom roles) for AAD itself.
Currently there's too many activities that only a global admin can do. RBAC would allow us to delegate appropriate activities without increasing our security attack surface.
Ben Virkler
shared this idea
We have released a public preview of custom roles with support for a handful of permissions related to managing application registrations. We’re now working on support for enterprise application management permissions, and will continue to release more permissions iteratively over time.
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/roles-custom-overview
We very much appreciate all of your feedback here. We’re not done yet, so please keep letting us know what you think and where we can improve.
Regards,
Vince Smith
Azure Active Directory team
30 comments
-
Cedric
commented
As part of continous deployment, MSI of Sql managed instance needed to be granted with role "Directory reader". At this time, this operation should be done manualy cause we needed a key user with "global admin" right.
Should be great if we can delegate attribution's permission of a specfic AAD role (like directory reader) to a user or a group of users. -
Eric Raff
commented
Great work being done here. I am interested in creating a custom security reader role but need additional permissions added. Specifically the following 3 permissions. In short granting the Security Reader role does not allow security team to see Conditional Access policies in AAD.
"microsoft.aad.directory/policies/conditionalAccess/basic/read",
"microsoft.aad.directory/policies/conditionalAccess/policiesAppliedTo/read",
"microsoft.aad.directory/policies/conditionalAccess/owners/read" -
Paweł Borkowski (CodeTwo)
commented
MS has finally released this feature, check out this: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/roles-create-custom
-
Dennis van Doorn
commented
Just saw a tweet from AAD PM Rob de Jong stating Microsoft published an update of the AzureAD Preview module to create and assign custom roles in AzureAD.
Download:
https://www.powershellgallery.com/packages/AzureADPreview/2.0.2.32 -
Chris Swigart
commented
Could MS provide an update on this?
-
Anonymous
commented
Anu update on this?
-
robert meyering
commented
We are looking to create a Incident Responder role to allows RBAC for acknowledging Azure Identity Protection alerts for risky users.
-
Alan
commented
Like the other comments and up-votes before me, this functionality is sorely needed. I would rather not grant people the ability to modify AAD polices for instance just to allow them the permission to modify Risky Events (Security Admin required).
We need more granularity!!!
-
Dan
commented
Actively blocked by lack of support for this, and it looks like it has been in progress for seven months....
-
Anonymous
commented
Any update?
-
Anonymous
commented
Was shocked to discover this didn't exist already and that it was different from Azure custom roles
-
Matt Thompson
commented
Any update to this?
-
Gary Forsman
commented
Hey MS,
Any news or progress on this? Seen the requirement at multiple customers now, it's becoming a major issue.
-
Mads Højlund
commented
Any update to this?
-
Phiroj Shaik
commented
Eagerly waiting to hear its preview release date to run hands on custom AAD roles, currently this is deterrent to make wish delegations
-
Hi folks,
Very much appreciate the feedback here. Just wanted to provide an update - we are actively working on custom roles support for Azure AD. It's a big project, but we are making good progress. Thanks for your patience!Vince
-
Anonymous
commented
This is a serious impediment to our ability to automate management work. Without the ability to customize roles for AAD, the applications used to automate management work have more permissions than they need.
Please keep us updated.
-
ashwin sidharthan
commented
Eagerly waiting for this feature.
-
Kristoffer
commented
Do you have any roadmap or such around this issue?
-
Peter Selch Dahl commented
@Vince
Make sure that these new RBAC permissions covers both Azure AD and Office 365./Peter Selch Dahl
Azure MVP