How can I assign granular RBAC rights to Defender EASM Azure Resource

Question

When creating a Defender EASM Resource in Azure, there is no possibility to granularly assign RBAC Roles to this resource. In the Defender EASM Portal the "IAM" Section is missing for role assignment.

However in order to create the resource you need to be at least Contributor or Owner. This mean any admin that needs to administer Defender EASM also needs at least contributor rights on the RG.

This is does not reflect the least privilege principle, as I might want an admin to administer EASM in the RG, but not be able to create other resources in the RG.

Is there any solution to this to assign rights just for management of EASM without having to grant contributor rights on RG Level?

Answer 1

Hello @Sascha Reuter,

Welcome to Microsoft Q&A,

Currently, Microsoft does not support granular roles for Defender EASM resources, but you can create a custom role with EASM permissions.

You can assign this custom role to the users, who will be able to access only the EASM features.

Please upvote and accept the answer if it helps!