Microsoft Introduces Role-based Access Management Capabilities in Azure AD

Microsoft is introducing a series of new capabilities in Azure Active Directory, including custom roles for delegated app management to help enable fine-grained authorization and simplify management at scale in Azure and Microsoft 365.

According to a Tech Community blog, custom roles for delegated app management is now in general availability, enabling custom roles for app registration and enterprise apps for fine-grained control over what access admins have for app management.

Microsoft says centralized IT admins can manage the delegation of Azure AD roles by exercising lest privilege to keep IT systems secure.

For example, senior IT admins can delegate access management of the line of business applications to their owners and grant role to others on the IT team to manage specific apps.

Admins can create a custom role with just the permissions to manage user and group assignments for specific applications. Once the custom role is created, the centralized IT admin can assign the role to specific IT professionals within the scope of the app, essentially granting the ability to manage user and group assignments.

To create a custom role in Azure AD, according to Microsoft:

• Open the Roles and administrators tab, select New custom role.
• Provide a name and description for the role and select Next.
• Assign the permissions for the role. Search for credentials to select the microsoft.directory/servicePrincipals/appRoleAssignedTo/update permission.
• Review the new role. If everything looks good, select Create to create the new role.

To assign the custom role:

• Select the Enterprise applications tab and pick an application that you want to give someone access to manage user and group assignments.
• Navigate to the new Roles and administrators tab. You’ll see the custom role created above.
• Select the role to open the assignment blade, select Add assignment, and then select a person to add to the role.
• The assignee can now navigate to the application’s users and groups blade to verify the Add user option is enabled.

Microsoft says it is working on more features for Azure AD RBAC, including new custom role and administrative features, plus other least-privileged capabilities.

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!