I have a third party dev team i contracted to help us develop an APP. The app has a few api's that i need to host on Azure. how do i configure my subscription (authorization options) to allow this team to get access to my web app and api resources without giving them the keys to the kingdom?

@Andy Donkel Thanks for reaching out. Can you please confirm which azure resource you have hosted your API and are you using APIM to expose those API's? Assuming that you are hosting your API in azure webapps as per the tag added in the question and what to use APIM to access those API then to allow your third-party dev team to access your web app and API resources without giving them full access, you can create a new subscription in Azure API Management and configure it with the appropriate access policies. Here are the steps to create a new subscription. Once you have created the subscription , you can configure it with the appropriate access policies to restrict access to your web app and API resources. For example, you can use IP filtering to restrict access to specific IP addresses, or you can use OAuth 2.0 to authenticate and authorize access to your APIs. To configure OAuth 2.0 user authorization for the interactive test console in the Azure API Management developer portal, you can follow the steps outlined in the following document: Authorize test console of API Management developer portal using OAuth 2.0 user authorization . Import webapps API to APIM you can refer to this document .

Allow a third party dev team access to Azure resources

Accepted answer

MayankBargali-MSFT 70,126 Reputation points

2023-09-12T11:16:05.5433333+00:00

@Andy Donkel Thanks for reaching out. Can you please confirm which azure resource you have hosted your API and are you using APIM to expose those API's?

Assuming that you are hosting your API in azure webapps as per the tag added in the question and what to use APIM to access those API then to allow your third-party dev team to access your web app and API resources without giving them full access, you can create a new subscription in Azure API Management and configure it with the appropriate access policies. Here are the steps to create a new subscription.

Once you have created the subscription, you can configure it with the appropriate access policies to restrict access to your web app and API resources. For example, you can use IP filtering to restrict access to specific IP addresses, or you can use OAuth 2.0 to authenticate and authorize access to your APIs.

To configure OAuth 2.0 user authorization for the interactive test console in the Azure API Management developer portal, you can follow the steps outlined in the following document: Authorize test console of API Management developer portal using OAuth 2.0 user authorization.

Import webapps API to APIM you can refer to this document.
Please sign in to rate this answer.
Andy Donkel 20 Reputation points

2023-09-12T11:37:13.7133333+00:00

Thank you Mayan,

The dev team I have contracted has built the app and wrote the APIs. They are requesting access to host on Azure. I do not have the files. They are going to deploy them for us. the APIs are used to run queries against our Azure SQL Database to proved data to the app. Would I use OAuth to give them access to deploy and host APIs?

MayankBargali-MSFT 70,126 Reputation points

2023-09-12T12:10:58.0133333+00:00

@Andy Donkel Do you know in which service they are planning to deploy? The suggestion would be to create the resources (SQL, webapp etc.) and then give the Contributor access only to those services rather than giving permission to your azure subscription. There are different inbuild roles and you can refer to this document. In case your third-party team will be creating the resource then you should at least create a resource group and give contributor permission to that resource group team so they can create/deploy the resource.

Andy Donkel 20 Reputation points

2023-09-12T18:39:05.3+00:00

Looking through the documentation, Can you tell me where I create the user. I have built the scope, permissions, and added the resources for the outside dev team. I need to assign all of this to an identity. Do I do create those credentials in Active Directory?

MayankBargali-MSFT 70,126 Reputation points

2023-09-13T14:03:38.14+00:00

@Andy Donkel You can refer to this document to add the user in Microsoft Entra admin cente. Once they added/accepted invitation then you can provide the RBAC/custom permission to those users.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Allow a third party dev team access to Azure resources

1 additional answer

Your answer