Allow a third party dev team access to Azure resources

Question

Allow a third party dev team access to Azure resources

Andy Donkel 20

I have a third party dev team i contracted to help us develop an APP. The app has a few api's that i need to host on Azure. how do i configure my subscription (authorization options) to allow this team to get access to my web app and api resources without giving them the keys to the kingdom?

MayankBargali-MSFT 60,961 Reputation points

2023-09-14T02:39:42.9566667+00:00

Hi @Andy Donkel

Following up to see if my answer helps. Feel free to get back to me if you need any assistance.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.

MayankBargali-MSFT 60,961 Reputation points

2023-09-14T02:39:42.9566667+00:00

Hi @Andy Donkel

Following up to see if my answer helps. Feel free to get back to me if you need any assistance.

Please "Accept Answer" if the answer is helpful so that it can help others in the community.

Answer 1

MayankBargali-MSFT 60,961

@Andy Donkel Thanks for reaching out. Can you please confirm which azure resource you have hosted your API and are you using APIM to expose those API's?

Assuming that you are hosting your API in azure webapps as per the tag added in the question and what to use APIM to access those API then to allow your third-party dev team to access your web app and API resources without giving them full access, you can create a new subscription in Azure API Management and configure it with the appropriate access policies. Here are the steps to create a new subscription.

Once you have created the subscription, you can configure it with the appropriate access policies to restrict access to your web app and API resources. For example, you can use IP filtering to restrict access to specific IP addresses, or you can use OAuth 2.0 to authenticate and authorize access to your APIs.

To configure OAuth 2.0 user authorization for the interactive test console in the Azure API Management developer portal, you can follow the steps outlined in the following document: Authorize test console of API Management developer portal using OAuth 2.0 user authorization.

Import webapps API to APIM you can refer to this document.

Andy Donkel 20 Reputation points

2023-09-12T11:37:13.7133333+00:00

Thank you Mayan,

The dev team I have contracted has built the app and wrote the APIs. They are requesting access to host on Azure. I do not have the files. They are going to deploy them for us. the APIs are used to run queries against our Azure SQL Database to proved data to the app. Would I use OAuth to give them access to deploy and host APIs?
MayankBargali-MSFT 60,961 Reputation points

2023-09-12T12:10:58.0133333+00:00

@Andy Donkel Do you know in which service they are planning to deploy? The suggestion would be to create the resources (SQL, webapp etc.) and then give the Contributor access only to those services rather than giving permission to your azure subscription. There are different inbuild roles and you can refer to this document. In case your third-party team will be creating the resource then you should at least create a resource group and give contributor permission to that resource group team so they can create/deploy the resource.
Andy Donkel 20 Reputation points

2023-09-12T18:39:05.3+00:00

Looking through the documentation, Can you tell me where I create the user. I have built the scope, permissions, and added the resources for the outside dev team. I need to assign all of this to an identity. Do I do create those credentials in Active Directory?
MayankBargali-MSFT 60,961 Reputation points

2023-09-13T14:03:38.14+00:00

@Andy Donkel You can refer to this document to add the user in Microsoft Entra admin cente. Once they added/accepted invitation then you can provide the RBAC/custom permission to those users.

Allow a third party dev team access to Azure resources

0 additional answers

Activity