Entra ID - Role Based Access Control(RBAC)

Introduction to RBAC

• Role-Based Access Control (RBAC) is a method of managing access to resources based on the roles of individual users within an organization.
• In Entra, RBAC is a crucial component of its security model, ensuring that users have the appropriate access rights to perform their tasks.
• RBAC is a policy-neutral access-control mechanism defined around roles and privileges.
• The components of RBAC such as role-permissions, user-role and role-role relationships make it simple to perform user assignments.
• A role in RBAC encapsulates a set of permissions that are required to perform a particular function.
• In Entra, RBAC is implemented to provide granular control over who can access what. Users are assigned roles, and these roles carry permissions that determine what resources the users can access and what they can do with those resources.

Benefits of RBAC in Entra

1. Principle of Least Privilege:
   • Each user is given the least amount of privilege necessary to complete their job functions. This reduces the risk of users having more access rights than they need.
2. Efficient Access Control:
   • RBAC allows administrators to manage users and roles in a centralized manner, making it easier to control access across the system.
3. Improved Compliance:
   • With RBAC, it’s easier to comply with regulatory requirements because it’s clear who has access to what, and why.
4. Scalability:
   • As your organization grows, RBAC makes it easy to manage increasing numbers of users and resources.

Common Roles

Azure Entra ID (Azure AD) includes several built-in roles for managing resources:

1. Owner: Has full access to all resources including the right to delegate access to others.
2. Contributor: Can create and manage all types of Azure resources but can’t grant access to others.
3. Reader: Can view existing Azure resources.
4. User Access Administrator: Can manage user access to Azure resources.
5. Security Admin: Can manage security components, security policies, and view security data.
6. Security Reader: Can view security policies, security states, and view security data.
7. Global Administrator: Has access to all administrative features in Azure AD. The person who signs up for the Azure AD subscription becomes a Global Administrator.
8. Billing Administrator: Can make purchases, manage subscriptions, manage support tickets, and monitor service health.
9. Service Administrator: Has the same access as a User Access Administrator, and additional rights to manage service requests.
10. Security Operator: Can respond to security alerts - view, dismiss, and respond to alerts; update security settings; and run playbook actions.