When creating a custom role in Azure AD, what do the parameters in "Actions" really do?

user_3415380 0
Viewed 797

I'm looking into creating a custom Azure AD role to use as part of [Authorization] in an Azure web app service. When you include a list of "Actions", are you creating Permissions as well within that role?

Can the "Actions" be empty? Lets say I just want to test a Role in a controller and then control the data access from there? Do I really need anything in the "Actions" section?

azure-active-directory
1 Answers

There are two very different concepts:

  1. Custom Roles in Azure (for Role based access control of Azure resources)
  2. Application Roles in Azure AD (for authorization in an application that uses Azure AD)

Based on your question, you need to be looking closely into the 2nd one, i.e. Application Roles. They don't have any list of "Actions" as part of their definition. I'll try to give a little more detail on both 1 and 2 below to make it clear.

Custom Roles in Azure (they have "Actions" list, but won't be helpful in implementing authorization logic in your web application)

Microsoft Documentation - Custom Roles in Azure

Purpose - Azure already provides built-in roles as part of Azure Portal to manage access to your resources in Azure Portal based on assigned roles. If you have a scenario where none of the built in roles meet your requirement, you can create a custom role, but the purpose is still that you will assign this custom role to someone in order for them to be able to manage/work with provisioned resources in Azure. E.g. Owner or Reader for an Azure SQL database server or one or more virtual machines. You will use these roles from Azure portal/PowerShell/CLI etc.

These roles are very helpful in a big organization, where everyone cannot be an owner/administrator at the Azure Subscription level, but can still be given access at a granular level to only some of the Azure Subscription Resources (like databases, vms, logic apps, storage accounts or anything available in Azure subscription for that matter). This is done through Role-based Access Control through portal/PowerShell/CLI.

Example

{
  "Name":  "Virtual Machine Operator",
  "Id":  "88888888-8888-8888-8888-888888888888",
  "IsCustom":  true,
  "Description":  "Can monitor and restart virtual machines.",
  "Actions":  [
                  "Microsoft.Storage/*/read",
                  "Microsoft.Network/*/read",
                  "Microsoft.Compute/*/read",
                  "Microsoft.Compute/virtualMachines/start/action",
                  "Microsoft.Compute/virtualMachines/restart/action",
                  "Microsoft.Authorization/*/read",
                  "Microsoft.Resources/subscriptions/resourceGroups/read",
                  "Microsoft.Insights/alertRules/*",
                  "Microsoft.Insights/diagnosticSettings/*",
                  "Microsoft.Support/*"
  ],
  "NotActions":  [

                 ],
  "DataActions":  [

                  ],
  "NotDataActions":  [

                     ],
  "AssignableScopes":  [
                           "/subscriptions/{subscriptionId1}",
                           "/subscriptions/{subscriptionId2}",
                           "/subscriptions/{subscriptionId3}"
                       ]
}

Application Roles in Azure AD (these don't have "Actions" list, but are meant to be used for Authorization logic in your application)

Microsoft Documentation - Application Roles

Purpose - These roles are defined in the Application Manifest for an application that your organization is developing and that is registered in your Azure Active Directory. These roles are very specific to your application and can be used in application's code to implement Authorization logic for the authenticated users.

enter image description here

enter image description here

Using the "allowedMemberTypes" you can control who can be assigned these roles (to Users, Groups or even Applications).

You can then assign roles from Azure Portal or programmatically. One simple way would be like shown in screenshot below -

enter image description here

When trying to implement your Authorization logic, these roles will be available as role "claims". So you will be able to check for roles with code like below

if (context.User.HasClaim(ClaimTypes.Role, "Admin")) { ... }

Sample Application that creates application roles and then uses them for Authorization Authorization in a web app using Azure AD application roles & role claims

Example This is the JSON that will go as part of your application manifest.

"appRoles": [
  {
    "allowedMemberTypes": [
      "User"
    ],
    "description": "Creators can create Surveys",
    "displayName": "SurveyCreator",
    "id": "1b4f816e-5eaf-48b9-8613-7923830595ad",
    "isEnabled": true,
    "value": "SurveyCreator"
  },
  {
    "allowedMemberTypes": [
      "User"
    ],
    "description": "Administrators can manage the Surveys in their tenant",
    "displayName": "SurveyAdmin",
    "id": "c20e145e-5459-4a6c-a074-b942bbd4cfe1",
    "isEnabled": true,
    "value": "SurveyAdmin"
  }
]
user_101303850
Related