delegating user/permissions management for Azure resources

Question

Hello All, 

We have an internal IT group which is responsible for managing our corporate AD.  That AD ('\\zytex) is synched with AzureAD for authentication to our Office365 subscriptions. 

We do have several Azure subscriptions containing dev/test and production resources that we would like to control access to.  \\zytex users are visible and can be assigned roles and permissions to our subscriptions in Azure Portal.

We would like to delegate the ability to create permission groups for Azure and add/remove \\zytex users to those permissions groups to  a few developers instead of requiring internal IT to be involved.

We have been looking at administrative units and self-service groups, but we are unsure of the best way to implement our requirements.

please suggest the best practices.

Answer 1

If you're planning to control access to subscription resources for users, then you should be using RBAC in this case. However, if you want to allow users to create and manage their own groups and control access to resources in Azure AD, use self-service group management. Refer to - https://docs.microsoft.com/en-us/microsoft-365/enterprise/identity-self-service-group-management and https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-manage-groups

-----------------------------------------------------------------------------------------------------------------------------------
If this answer was helpful, click “Mark as Answer” and Up-Vote. To provide additional feedback on your forum experience, click here 

 

Answer 2

@Tekbloke, Just checking in if you have had a chance to see our previous response. If this answers your query, do click “Mark as Answer” and Up-Vote for the same. And, if you have any further query do let us know.

Answer 3

thank you Sadiq...was just wondering which one do you suggest the best from the above 2 links...and are there any best practices for the same ?

Answer 4

@Tekbloke, For your use case, RBAC should be a good fit - https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles. However, based on your requirement and scenario specific demand you might have to use multiple features together.

-----------------------------------------------------------------------------------------------------------------------------------
If this answer was helpful, click “Mark as Answer” and Up-Vote. To provide additional feedback on your forum experience, click here 

Answer 5

@Tekbloke, Checking in to see if the above suggestions helped or you need further assistance on this issue. If that answers your query, do click “Mark as Answer” and Up-Vote for the same.