How can we improve Azure Active Directory?

← Azure Active Directory

RBAC role for Tagging only

Please create a new RBAC roles for "Tag Contributor" and "Tag Reader"

We currently have no way to restrict a service account to be able to automatically add tags to resources without granting the service account "Contributor" rights on all our subscriptions. Huge security concern.

7 votes
Sign in
(thinking…)
Sign in with: Microsoft
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

Ian Moroney shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

2 comments

Attach a File
Sign in
(thinking…)
Sign in with: Microsoft
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Rene Løhde commented  ·   ·  Flag as inappropriate

    Could we rephrase this as "Implement Resource Provider Operations (Actions) for Tag on each of the Azure resources" ...I am guesssing that this issue is due to the top-level implementation of the Tag-action at the subscription level:

    Microsoft.Resources/subscriptions/tagNames/read
    Microsoft.Resources/subscriptions/tagNames/write
    Microsoft.Resources/subscriptions/tagNames/delete
    Microsoft.Resources/subscriptions/tagNames/tagValues/delete
    Microsoft.Resources/subscriptions/tagNames/tagValues/read
    Microsoft.Resources/subscriptions/tagNames/tagValues/write

    Where-as, what is really needed to gain granular control is somthing like:

    Microsoft.Compute/virtualMachines/tagNames/*
    Microsoft.Compute/virtualMachines/tagNames/tagValues/*
    ...
    Microsoft.Storage/storageAccounts/virtualMachines/tagNames/*
    Microsoft.Storage/storageAccounts/virtualMachines/tagNames/tagValues/*
    ...

    Additional use-cases: Role that can start/stop VM and change tags (with-out having to allow for "Microsoft.Compute/virtualMachines/write" in the custom role)

  • AK commented  ·   ·  Flag as inappropriate

    Agreed, we cannot promote governance and cost-control properly if we have no control over tag changes.

Azure Active Directory: Role-based Access Control

Feedback and Knowledge Base

(thinking…)
Hosted by UserVoice