I have subscription , in the subscription there are so many users with contributor access , i want to give access to see the state file to only one spn user how can we do that?

Question

i have azure subsciption , i have contributor role for multiple users in the subscription leval , i have one storage account , in the storage account one state file is there, it only visisble for one particular spn user other then all the contributor users can't able to view how can we do that in azure?

Answer 1

Hello, @Tamil Selvan M !

How do I block access to only a single resource group?

You can grant access to users using Role Based Access Control (RBAC) at 4 different scopes:

• Management group
• Subscription
• Resource Group
• Resource

The issue with this is that if access is granted at a higher scope (like the subscription), then access is inherited at lower scopes (like a resource group).

One way to do this is to grant access at the resource group level (granting access to resource group A but not resource group B) but this becomes difficult to manage if you are trying to deny access to a single resource group out of possibly dozens or more resource groups.

Other options:

• Remove role assignments: Would have to be done at a lower scope (every resource group) or else you would run into an inherited role assignments cannot be removed error.
• Deny assignments can remove an ability but has drawbacks as well.
• Locking resources can work for some scenarios like delete, but would still allow read only.
• Azure Blueprints offers additional options but doesn't directly address this issue.

Here I agree with the blog by Jussi Roine who recommends creating a separate subscription and moving the single resource group there so that you have isolation at equal scopes:

https://jussiroine.com/2021/05/how-to-lock-down-a-single-confidential-resource-group-in-azure/

Additional reading:

• Remove Azure role assignments
• List Azure deny assignments
• Lock your resources to protect your infrastructure
• Quickstart: Check access for a user to a single Azure resource
• What is Azure Blueprints (Preview)?

---

I hope this has been helpful! Your feedback is important so please take a moment to accept answers.

If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!