As an administrator or developer using the Azure portal, you may need to grant access to resources to other users or teams within your organization. There are various ways to do this, depending on the type of resource and the level of access you want to grant. In this blog post, we will explore some of the options available to you for assigning access to resources in the Azure portal.

One of the first things to consider when assigning access to resources is the type of resource you are working with. Different types of resources have different methods for assigning access, so it is important to understand the options available to you. Here are a few common types of resources you may need to grant access to:

For each of these types of resources, there are different methods you can use to assign access. Let's take a look at a few of the options available.

Virtual Machines (VMs)

To grant access to a VM, you can use either role-based access control (RBAC) or Remote Desktop Protocol (RDP).

RBAC allows you to assign specific roles to users or groups, giving them the ability to perform certain actions on the VM. For example, you might grant a user the "Virtual Machine Contributor" role, which allows them to manage and configure VMs, but not delete them.

RDP, on the other hand, allows you to remotely connect to a VM using a remote desktop client. This can be useful for managing the VM or troubleshooting issues. To grant RDP access, you will need to configure the VM's network security group (NSG) to allow RDP traffic.

Web Apps

To grant access to a web app, you can use either RBAC or the Azure Active Directory (AAD) authentication provider.

RBAC allows you to assign specific roles to users or groups, giving them the ability to perform certain actions on the web app. For example, you might grant a user the "Web App Contributor" role, which allows them to manage and configure the web app, but not delete it.

AAD authentication allows you to authenticate users using their Azure AD credentials. This can be useful if you want to grant access to the web app to a specific group of users within your organization. To enable AAD authentication, you will need to configure the web app's authentication settings in the Azure portal.

Azure Functions

To grant access to an Azure Function, you can use either RBAC or the Azure Functions host key.

RBAC allows you to assign specific roles to users or groups, giving them the ability to perform certain actions on the function. For example, you might grant a user the "Function App Contributor" role, which allows them to manage and configure the function, but not delete it.

The Azure Functions host key allows you to authenticate requests to the function using a shared key. This can be useful if you want to grant access to the function to external applications or users. To obtain the host key, you will need to navigate to the "Function app settings" blade in the Azure portal.

Azure Storage

To grant access to an Azure Storage account, you can use either RBAC or Shared Access Signatures (SAS).

RBAC allows you to assign specific roles to users or groups, giving them the ability to perform certain actions on the storage account. For example, you might grant a user the "Storage Account Contributor" role, which allows them to manage and configure the storage account, but not delete it.

Shared Access Signatures (SAS) allow you to grant access to specific resources within the storage account to specific users or applications. SAS tokens can be configured to grant access for a specific time period, and can be restricted to specific actions (such as read or write access). To create a SAS token, you will need to use the Azure Storage REST API or one of the Azure Storage client libraries.

Azure Databases

To grant access to an Azure Database, you can use either RBAC or database authentication.

RBAC allows you to assign specific roles to users or groups, giving them the ability to perform certain actions on the database. For example, you might grant a user the "SQL Database Contributor" role, which allows them to manage and configure the database, but not delete it.

Database authentication allows you to create user accounts within the database itself, and grant them access to specific resources within the database. This can be useful if you want to grant access to specific tables or stored procedures within the database. To create a user account, you will need to use T-SQL commands or the Azure portal.

Conclusion

In this blog post, we have explored some of the options available for assigning access to resources in the Azure portal. By understanding the different methods available, you can choose the one that best fits your needs and grant access to the resources your users or applications need.

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal