Why identity management is foundational in Azure - Why It Works

Introduction

Identity management helps control who can access your cloud resources. It solves the problem of keeping your data and apps safe by making sure only the right people or services can use them.

When you want to give your team members access to specific cloud apps without sharing passwords.

When you need to control which services can talk to each other securely in your cloud environment.

When you want to track who did what in your cloud to find problems or security issues.

When you want to avoid giving everyone full access and instead give only the permissions they need.

When you want to use single sign-on so users can log in once and access many apps safely.

Commands

This command logs you into your Azure account so you can manage resources securely.

Terminal

az login

Expected Output

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code ABCD1234 to authenticate.



You have logged in. Now let us find all the subscriptions to which you have access...

This command shows details about a specific user in Azure Active Directory to verify their identity and permissions.

Terminal

az ad user show --id [e-mail]

Expected Output

{

  "accountEnabled": true,

  "displayName": "Example User",

  "mail": "[e-mail]",

  "userPrincipalName": "[e-mail]",

  "id": "12345678-90ab-cdef-1234-567890abcdef"

}

→

--id - Specifies the user to show by their email or user ID

This command assigns the Reader role to the user for a specific subscription, giving them read-only access to resources.

Terminal

az role assignment create --assignee [e-mail] --role Reader --scope /subscriptions/00000000-0000-0000-0000-000000000000

Expected Output

{

  "canDelegate": null,

  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleAssignments/abcdef12-3456-7890-abcd-ef1234567890",

  "name": "abcdef12-3456-7890-abcd-ef1234567890",

  "principalId": "12345678-90ab-cdef-1234-567890abcdef",

  "roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",

  "scope": "/subscriptions/00000000-0000-0000-0000-000000000000",

  "type": "Microsoft.Authorization/roleAssignments"

}

→

--assignee - Specifies the user or service to assign the role

→

--role - Specifies the role to assign

→

--scope - Specifies the resource scope for the role assignment

This command lists all role assignments for the user to verify their permissions.

Terminal

az role assignment list --assignee [e-mail]

Expected Output

[

  {

    "roleDefinitionName": "Reader",

    "scope": "/subscriptions/00000000-0000-0000-0000-000000000000",

    "principalId": "12345678-90ab-cdef-1234-567890abcdef"

  }

]

→

--assignee - Filters role assignments by user or service

Key Concept

If you remember nothing else from this pattern, remember: controlling who can access what in your cloud keeps your data safe and your apps working right.

Common Mistakes

Giving users more permissions than they need.

This can lead to accidental or malicious changes that harm your cloud resources.

Assign only the minimum roles needed for users to do their jobs.

Not verifying user identities before assigning roles.

This can allow unauthorized users to gain access.

Always check user details in Azure Active Directory before role assignment.

Skipping the verification of role assignments after creation.

You might think permissions are set correctly when they are not.

Use commands to list role assignments and confirm permissions.

Summary

Use 'az login' to securely sign in to your Azure account.

Check user details with 'az ad user show' before assigning roles.

Assign roles with 'az role assignment create' to control access.

Verify permissions with 'az role assignment list' to ensure correct access.