Give someone access to ONLY their sandbox on Azure

Question

Hi;

How can I give someone access to our Azure account where they can only do things in the sandbox I give them and have no access to any of our existing resources/services?

Do I create a Resource Group for them? And then how do I give them access to only that recourse group?

Also, can I put a budget limit on them? (I trust them to not purposely go over their budget, but people make mistakes and they might set a ML training session that runs all weekend when they thought it would be 20 minutes.)

And please, not just what to do, but how to do it.

thanks - dave

Answer 1

Hi @David Thielen ,

The Sandbox environment is intended to be an isolated environment where users have unrestricted access to create any resources they want. It needs to be created in an isolated Microsoft Entra ID tenant with its own subscription; both the tenant and the subscription are specific to that Sandbox environment. The users should not have access to your other resources because they should only be given access to the sandbox.

From there, you can implement more granular controls to limit the Deploy-Budget cap, placing a tag to set an expiration date on the subscription, and setting a blocklist via Azure Policy to limit the types of resources the users can deploy.

Otherwise, there isn't a way to set this type of access control within the same subscription. You can implement role-based access control or create custom roles. You can also use Azure Blueprints to set resource locks, but that only works for new resources and not existing ones.

So in short, I don't think the requirement you're looking for exists if you're trying to have sandboxes and real Azure resources within the same subscription and tenant. The sandboxes are designed for unrestricted, isolated access. Feel free to clarify though if I misunderstood your ask!

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions.