RBAC for AAD
The Azure teams have done an awesome job implementing RBAC. I would love to have this same functionality (granular permissions + custom roles) for AAD itself.
Currently there's too many activities that only a global admin can do. RBAC would allow us to delegate appropriate activities without increasing our security attack surface.
We have released a public preview of custom roles with support for a handful of permissions related to managing application registrations. We’re now working on support for enterprise application management permissions, and will continue to release more permissions iteratively over time.
We very much appreciate all of your feedback here. We’re not done yet, so please keep letting us know what you think and where we can improve.
Azure Active Directory team
As part of continous deployment, MSI of Sql managed instance needed to be granted with role "Directory reader". At this time, this operation should be done manualy cause we needed a key user with "global admin" right.
Should be great if we can delegate attribution's permission of a specfic AAD role (like directory reader) to a user or a group of users.
Eric Raff commented
Great work being done here. I am interested in creating a custom security reader role but need additional permissions added. Specifically the following 3 permissions. In short granting the Security Reader role does not allow security team to see Conditional Access policies in AAD.
Paweł Borkowski (CodeTwo) commented
MS has finally released this feature, check out this: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/roles-create-custom
Dennis van Doorn commented
Just saw a tweet from AAD PM Rob de Jong stating Microsoft published an update of the AzureAD Preview module to create and assign custom roles in AzureAD.
Chris Swigart commented
Could MS provide an update on this?
Anu update on this?
robert meyering commented
We are looking to create a Incident Responder role to allows RBAC for acknowledging Azure Identity Protection alerts for risky users.
Like the other comments and up-votes before me, this functionality is sorely needed. I would rather not grant people the ability to modify AAD polices for instance just to allow them the permission to modify Risky Events (Security Admin required).
We need more granularity!!!
Actively blocked by lack of support for this, and it looks like it has been in progress for seven months....
Was shocked to discover this didn't exist already and that it was different from Azure custom roles
Matt Thompson commented
Any update to this?
Gary Forsman commented
Any news or progress on this? Seen the requirement at multiple customers now, it's becoming a major issue.
Mads Højlund commented
Any update to this?
Phiroj Shaik commented
Eagerly waiting to hear its preview release date to run hands on custom AAD roles, currently this is deterrent to make wish delegations
Very much appreciate the feedback here. Just wanted to provide an update - we are actively working on custom roles support for Azure AD. It's a big project, but we are making good progress. Thanks for your patience!
This is a serious impediment to our ability to automate management work. Without the ability to customize roles for AAD, the applications used to automate management work have more permissions than they need.
Please keep us updated.
ashwin sidharthan commented
Eagerly waiting for this feature.
Do you have any roadmap or such around this issue?
Peter Selch Dahl commented
Make sure that these new RBAC permissions covers both Azure AD and Office 365.
/Peter Selch Dahl