Most of us have years of experience with Active Directory and delegating rights to Administrators that control the environment. Some enterprises don’t grant Domain Admin rights to all the Administrators. How does one set up just the right amount of access in Azure for Admins to manage the WVD Spring release?
To answer this question, I started with Role Base Access Control (RBAC). In this scenario, the Administrators will have the Contributor role on the Azure subscription, and the Admin should have the ability to manage other users’ permissions both in Azure and WVD.
Azure uses RBAC to manage resources. A role is a group of permissions.
Azure has many built-in roles; some of the main are Owner, Contributor, and Reader. See here for a list of built-in roles. You can also use PowerShell to get a list with the command: Get-AzRoleDefinition | FT Name,Description
The Owner role has full access to everything, including the ability to delegating access to users. The Contributor role has the permissions to create and manage resources, even create a new tenant but, cannot delegate access to users. The Reader role can view all but make now changes.
If the Administrator has Owner, the person would have full access to manage all resources, but we don’t want that for our Administrator in this case. We know the Administrator has the Contributor role. However, that means the Administrator does not have the right to delegate access to users. The Administrator will need the ability to add and remove users/groups to WVD.
There are multiple ways to solve this; you can grant the Administrator rights on the individual resource groups.
You can add a custom role. If you are more comfortable with the GUI, select Subscriptions, Access control (IAM), Add custom role.
To make it easier, you can choose to clone a role as a starting point.
The predefined permissions already defined will give you a good starting point.
However, to accomplish the requirements, it will need to be adjusted.
You can add permissions and exclude permissions from the above page, but there are limitations. The better method would be to edit the JSON.
Below is a JSON example:
{
“properties”: {
“roleName”: “Custom_Admins”,
“description”: “Custom Role to allow contribution and access control”,
“assignableScopes”: [
“/subscriptions/subscriptionID”
],
“permissions”: [
{
“actions”: [
“Microsoft.Authorization/roleAssignments/delete”,
“Microsoft.Authorization/roleAssignments/write”,
“Microsoft.DesktopVirtualization/*”
],
“notActions”: [
“Microsoft.Blueprint/blueprintAssignments/write”,
“Microsoft.Blueprint/blueprintAssignments/delete”,
],
“dataActions”: [],
“notDataActions”: []
}
]
}
}
For a list of operations see here
To use the PowerShell to create the custom role using a json file:
New-AzRoleDefinition –InputFile “C:\CustomRoles.json”
This solution is granular and most secure, but it will involve some research and knowledge of JSON. If you are new to Azure, this can be challenging.
So, for this use case since the granular security is not a requirement, the Administrator will be granted two built-in roles that allow for the access needed, not just for WVD but Azure as well.
