To grant users access to specific Azure subscriptions via Azure AD Groups, you assign a role to the group at the subscription level. Here’s a step-by-step guide:
1. Prerequisites
- Permissions Required:
Ensure you have the Owner or User Access Administrator role on the subscription where you want to grant access. - Azure AD Group:
Ensure the group you want to use exists in Azure Active Directory, and it contains the appropriate users.
2. Create or Identify an Azure AD Group
- Go to Azure Active Directory in the Azure portal.
- Select Groups from the left-hand menu.
- If the group already exists, ensure it has the necessary users as members. Otherwise:
- Click New group.
- Provide a name and description for the group.
- Add users as members of the group.
- Save the group.
3. Assign a Role to the Group at the Subscription Level
- Go to the Subscriptions page:
- In the Azure portal, search for and select Subscriptions.
- Choose the subscription where you want to assign access.
- Navigate to Access Control (IAM):
- On the subscription’s page, click Access control (IAM) in the left-hand menu.
- Click Add Role Assignment:
- Click the + Add button and select Add role assignment.
- Configure the Role Assignment:
- Role: Choose the role you want to assign (e.g., Contributor, Reader).
- Assign access to: Select User, group, or service principal.
- Select Members: Search for and select the Azure AD group you created or identified earlier.
- Click Save.
4. Verify the Role Assignment
- Go back to Access Control (IAM) for the subscription.
- Under the Role assignments tab, verify that the group appears with the assigned role.
5. Test User Access
- Users in the group should now have access to the subscription based on the role assigned to the group.
- Ask a member of the group to sign in and verify access to the subscription.
6. Manage Membership in the Group
- To add or remove access for users, simply update the group’s membership:
- Go to Azure Active Directory > Groups.
- Select the group and add or remove members as needed.
Benefits of Using Groups for Subscription Access
- Centralized Management: You can manage access by modifying group membership instead of assigning roles individually.
- Scalability: Easily grant or revoke subscription access for multiple users by adding or removing them from the group.
- Consistency: Simplifies role management across multiple subscriptions and resources.
By following this method, you ensure users have the correct access to specific subscriptions while maintaining streamlined and secure management practices.