Transition to role-based access control (RBAC) in Azure by 31 August 2024

Raghavendra Mamidi 10

Hi I got a mail like below:
Transition to role-based access control (RBAC) in Azure by 31 August 2024

Can you please tell me how can i make RBAC in Aure.

Givary-MSFT 30,931 Reputation points Microsoft Employee

2024-04-01T08:27:47.1233333+00:00

@Raghavendra Mamidi Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

4 answers

Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-12T11:52:24.52+00:00

Hi Thanks for the question . I think the email you're referring to is this:

Transition to role-based access control (RBAC) in Azure by 31 August 2024 You're receiving this notice because you use Azure classic administrator roles. On 31 August 2024, Azure classic administrator roles will be retired. If your organization has active Co-Administrator or Service Admin roles, you'll need to transition to using Azure RBAC roles by then. (All Azure classic resources and Azure Service Manager will also be retired on that date.) You may continue using these Azure classic admin roles until they're retired. However, starting 3 April 2024, you'll no longer be able to add new Co-Administrator roles through the Azure portal. Required action
To avoid potential disruptions in service, transition any classic admin roles that still need access to your subscription to an Azure RBAC role by 31 August 2024, when classic admin roles will no longer be supported ....

Which links to an informational page here which explains how to plan for transition https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators#prepare-for-co-administrators-retirement

Essentially you are being notified that one or more user accounts for one or more Azure Subscriptions you manage has an administrator and/or co-administrator assignment.

As the email explains RBAC (or Roles Based Access Control) , see here for overview: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview replaces the original (classic) admin accounts and provides you far more granular access control and it therefore much more secure as you can implement least privilege , assigning directly or delegating users only enough permission to achieve their objectives.

To understand more about RBAC there are some helpful guides including:
How to check who has access https://learn.microsoft.com/en-us/azure/role-based-access-control/check-access
And how to grant access https://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal

Hope this helps you
Please sign in to rate this answer.
Raghavendra Mamidi 10 Reputation points

2024-03-12T12:09:39.2666667+00:00

Okay Thank you, So I will be good if I make the access to the role assignment, right as shown in the above screenshot?

Is Role Assignment and RBAC is same?
Sign in to comment
Izhan Jamal 0 Reputation points

2024-03-12T12:26:06.74+00:00

Do we simply need to transition the user with co-admin access to role-based access, assigning them only the necessary roles?
Please sign in to rate this answer.
Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-12T12:45:14.96+00:00

Hi - Yes exactly that, the steps below should apply equally to admins as co-admins
https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators#prepare-for-co-administrators-retirement

Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-12T12:46:22.73+00:00

The end goal is to have only users assigned permission through RBAC and no users using the original admin/co-admin access

Izhan Jamal 0 Reputation points

2024-03-12T12:54:32.73+00:00

The document doesn't show steps to add roles. It just shows how to remove co admin etc.

Also in this transition do we need to change our classic resource to azure resource manager. How would I know if my resources are classic or arm.

Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-12T13:34:55.3866667+00:00

To understand more about RBAC there are some helpful guides including: How to check who has access https://learn.microsoft.com/en-us/azure/role-based-access-control/check-access And how to grant access https://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal

Izhan Jamal 0 Reputation points

2024-03-13T06:52:10.8+00:00

Currently, we have Co-admins. To grant the same level of access, which roles should we assign? Alternatively, can we provide privileged access roles, such as the owner role, for full access?

Raghavendra Mamidi 10 Reputation points

2024-03-13T08:43:57.84+00:00

@Izhan Jamal I think we need to add the role assignment for the co-admins

Izhan Jamal 0 Reputation points

2024-03-13T08:46:31.61+00:00

Can you guide which roles I can assign to give same level of access as co-admins.

Raghavendra Mamidi 10 Reputation points

2024-03-13T09:09:48.2366667+00:00

I am not sure the same, @Ben Gimblett Can you please help us on it?

Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-13T10:59:08.7333333+00:00

from the Az resource perspective co-admin and admin both equate to RBAC "owner"

The original "classic" roles "service admin" and "account admin" went beyond the Az resource scope - as described here
https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles
I dont know enough about the account/billing side (and this varies depending on your agreement with MSFT) to comment more though.
Sign in to comment
Raghavendra Mamidi 10 Reputation points

2024-03-12T13:08:09.21+00:00

Can you please check the below image and confirm we should Add the role assignment?
Please sign in to rate this answer.
Raghavendra Mamidi 10 Reputation points

2024-03-12T13:09:44.0133333+00:00

Instead of co-administrator we need to Add the Add role assignment right?

Raghavendra Mamidi 10 Reputation points

2024-03-12T13:10:01.3433333+00:00

Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-12T13:35:22.4566667+00:00

correct

Raghavendra Mamidi 10 Reputation points

2024-03-13T08:41:44.4033333+00:00

Okay @Ben Gimblett , and I have some mail id's they have Co-administration access should i change them to to the role assignment in the azure portal?

Ben Gimblett 3,845 Reputation points Microsoft Employee

2024-03-13T11:08:27.2233333+00:00

you must convert all existing users - or remove the users no longer required

please dont grant permissive RBAC to users that you dont know or trust, or user accounts that are no longer required. These should be cleaned up instead.

Ideally you should not use "owner" or the high privilege roles at all, instead opting for least privilege and combination of roles to allow people to fulfil their job function

The ideal state is to have no real user access to a production subscription at all, and maintain only one or more deployment service principals for automated deployment pipeline (in this scenario you may also choose to vault credentials for one high privilege "break glass" account for emergencies)

Izhan Jamal 0 Reputation points

2024-03-14T06:27:52.4+00:00

@Raghavendra Mamidi are you giving owner roles to co-admins?

Izhan Jamal 0 Reputation points

2024-03-18T05:56:06.0033333+00:00

@Raghavendra Mamidi have you completed it?
Sign in to comment
Raghavendra Mamidi 10 Reputation points

2024-03-12T13:08:27.75+00:00

Can you please check the below image and confirm we should Add the role assignment?
Please sign in to rate this answer.
Raghavendra Mamidi 10 Reputation points

2024-03-12T13:08:50.96+00:00
Sign in to comment

Share via

Transition to role-based access control (RBAC) in Azure by 31 August 2024

4 answers