Azure users must only be assigned to groups

55 views Asked by At

At the moment most users are given default roles in Azure such as Contributor or User. We need to prevent this and only allow users to be added only in AD groups. And these groups need to be provided Azure access(IAM). I am thinking of using Azure Policy for this. But cannot find any documentation in this regard.

1

There are 1 answers

0
Rob S. On

Unfortunately, as of today (Oct 20, 2020), I do not believe this is possible with policy. It is my understanding that Azure Policy intentionally draws a distinct line between Azure Resources and anything Azure Active Directory or RBAC related. Azure Policy is meant to be agnostic of roles and users with an exception to the roles required to perform a remediation in deployIfNotExists policies.

https://learn.microsoft.com/en-us/azure/governance/policy/overview#azure-policy-and-azure-rbac