Skip to content

DOC-299: Update Azure Role Definition and Role Assignment articles #900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
quetzalliwrites wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −1
Open

DOC-299: Update Azure Role Definition and Role Assignment articles #900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion src/content/docs/azure/services/role-assignment.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,9 +340,12 @@ The default SDK/Terraform service principal and the `az` CLI's `any-app` princip
## Limitations

- **RBAC enforcement is opt-in:** By default, role assignments are stored but not evaluated, and all operations succeed regardless of assigned roles. Set `LS_AZURE_ENFORCE_RBAC` to enable enforcement.
- **Data-plane coverage is partial:** Enforced for Storage (Blob/Queue/Table), Key Vault (secrets and certificates), and Event Grid. Not yet enforced for Storage File, the Service Bus data plane, or Cosmos DB. Azure SQL Database and Azure Database for PostgreSQL/MySQL flexible servers don't use RBAC data actions (their data-plane authorization is Microsoft Entra database authentication), so they're out of scope for RBAC.
- **Key Vault keys:** Only the secrets and certificates data planes are enforced; the keys data plane is not yet implemented.
- **Condition-based assignments:** Attribute-based access control (ABAC) conditions in assignments are accepted at the model level but are not evaluated.
- **Deny assignments:** `Microsoft.Authorization/denyAssignments` are not supported.
- **Management group scopes:** Assignments at management group scope are not supported.
- **Management group scopes:** Assignments at management group scope are not supported. Subscription, resource group, and resource scopes are supported, including inheritance down the hierarchy — a role assigned at a broader scope applies to narrower scopes beneath it.
- **Groups and transitive membership:** A role assigned to a group is not expanded to its members; only assignments made directly to the calling principal are evaluated.

## Samples

Expand Down
1 change: 1 addition & 0 deletions src/content/docs/azure/services/role-definition.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,7 @@ az role definition list --name "Custom Storage Reader"
## Limitations

- **RBAC enforcement is opt-in:** By default, role definitions and assignments are stored but permissions are not enforced, so API calls are not gated the way they are in Azure. Set `LS_AZURE_ENFORCE_RBAC` to enable enforcement; see [Role Assignment: Enabling RBAC enforcement](/azure/services/role-assignment/#enabling-rbac-enforcement) for scope and coverage.
- **Key Vault keys:** Role definitions can include `DataActions` permissions for Key Vault keys, but the keys data plane is not yet enforced — only secrets and certificates are.
- **Management group scopes:** Management group–level assignable scopes are not supported.

## Samples
Expand Down
Loading