Creating a resource guard and enabling multiuser authentication

Question

Hey all, I need to improve the security on our vaults and was planning on working my through creating the guard and then enabling multiuser authentication, my problem is our permissions are not that granular. So im wondering what the impact would be if the users assigned to the guard are all Global Admins, meaning if someone was trying to change a policy for example would that prompt others to approve it before it could be completed or would their rights exclude them from needing approval?
Thanks

Answer 1

Hi,

Global Admins is not Azure RBAC role. Global Admins is Microsoft Entra role. By Default Global Admins do not have access to Azure subscriptions but they can elevate themselves and gain access to any subscription. But keep in mind that resource guard only works if the users that should not have the permissions do not have permissions on the resource guard resource. That is why the resource guard resource is usually in another subscription to prevent users who have access to the vault does not have access to the resource guard resource.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.