Managing Subscriptions and RBAC in Azure

This is just a summary. Find the complete lab instructions on GitHub!

Scenario

Simplify Azure resource management by:

Creating a management group for your subscriptions.
Granting Help Desk the ability to submit support requests, limited to:
- Creating and managing virtual machines
- Creating support request tickets (excluding adding Azure providers)

Interactive Simulations

Optional simulations to reinforce your understanding:

Manage access with RBAC: Assign roles and monitor activity logs.
Manage subscriptions and RBAC: Implement a management group and create/assign roles.
Open a support request: Review options, create and monitor requests.

Architecture Diagram

Diagram of lab tasks.

Task 1: Implement Management Groups

Sign in to the Azure portal: https://portal.azure.com
Navigate to: Microsoft Entra ID > Properties > Management groups > + Create
Create a management group:

Management group ID az104-mg148607161 (must be unique)

Management group display name az104-mg148607161 |

Task 2: Assign Built-in Role

Select the az104-mg148607161 management group.
Navigate to: Access control (IAM) > Roles > + Add > Add role assignment
Select "Virtual Machine Contributor" role.
Assign the role to the helpdesk group.

Task 3: Create Custom RBAC Role

Navigate to: Access control (IAM) > + Add > Add custom role
Configure the custom role:

Custom role name Custom Support Request48607161

Description A custom contributor role for support requests.

Baseline permissions Clone "Support Request Contributor"
Exclude the "Registers Support Resource Provider" permission.
Ensure your management group is listed in "Assignable scopes".
Review the JSON and create the role.

Task 4: Monitor Role Assignments

For the az104-mg148607161 resource, select "Activity log".
Review the role assignment activities.

Screenshot of the Activity log page with configured filter.

Cleanup

Delete the lab resources to avoid unnecessary costs.

Azure portal: Delete the resource group.
PowerShell: Remove-AzResourceGroup -Name resourceGroupName
CLI: az group delete --name resourceGroupName

⚖

MIT License Copyright (c) 2019 Sidney Andrews Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Managing Subscriptions and RBAC in Azure

Comments

AZ-104

Managing Governance via Azure Policy

More from this blog

AZ-140 Lab tips II:

AZ-700 Lab 03

AZ - 700 Lab 2

AZ - 700 - 03 - Design and implement Azure ExpressRoute

AZ - 700 Lab 1

Scenario

Interactive Simulations

Architecture Diagram

Task 1: Implement Management Groups

Task 2: Assign Built-in Role

Task 3: Create Custom RBAC Role

Task 4: Monitor Role Assignments

Cleanup

Command Palette

Comments

AZ-104

Managing Governance via Azure Policy

More from this blog

Scenario

Interactive Simulations

Architecture Diagram

Task 1: Implement Management Groups

Task 2: Assign Built-in Role

Task 3: Create Custom RBAC Role

Task 4: Monitor Role Assignments

Cleanup