Chapter 4: Managing User Authorization

In the previous chapter, we covered how users are authenticated in solutions; this is the act of proving who you are. Once they have access, you must continually ensure that authenticated users can only access what they should – this is known as authorization.

At its simplest, some users may need administrative access to do everything within the Azure portal. In contrast, some users may only want to be able to read or view a specific resource.

In reality, you will have a vast mix of requirements everywhere between those two extremes – and of course, it's not just access to the Azure portal you will want to control, but all the apps and services you created in it.

In this chapter, we will examine how access control is performed using Active Directory (AD) roles and Azure roles.

Then, we'll look at how to manage the flow of access, using AD groups, management groups, subscriptions, and resource groups.

We'll...