Grant Employee Access with Azure RBAC

Create group-based, read-only Azure access and audit the role assignment.

Introduction

30 Second Summary

New employees need enough access to start contributing on day one. A permission that reaches too far can also let someone change things they only need to view.

In this project, you will build a least-privilege onboarding model with Microsoft Entra ID and Azure RBAC. You will give a fictional support analyst read-only access to one development resource group through a security group.

What You'll Build

You will open one development resource group to trace Avery Support's read-only access from security-group membership to the administrator's audit record.

By the end of this project, you'll have:

A new employee identity whose membership in gp-rg-readers is visible in Microsoft Entra ID.
A before-and-after access check that starts with no Azure role. After the group receives Reader, the same check shows read-only access limited to rg-iam-newhire-lab.
An audit trail in Azure Activity Log that identifies the administrator who created the role assignment.
Secret Mission: Add Jordan Support to the existing group. You will prove that the same Reader access works without creating another Azure role assignment.

What do you need before starting?

You need a Windows device with Microsoft Edge, a phone number, a credit card or non-prepaid debit card, plus access to a Microsoft or GitHub account. Azure might place a temporary $1 authorization hold on your card.

The card check can feel like a payment step, but Azure does not charge free-account customers unless they choose pay-as-you-go.

Before We Start

Before any hands-on work begins, lock in the access problem this lab solves. This commitment gives every later permission choice a clear least-privilege goal.

Set Up Your Free IAM Lab

Your least-privilege plan needs an isolated cloud space. You also need authority over its directory identities plus its resource permissions.

Microsoft Azure supplies the subscription for your lab. Microsoft Entra ID supplies the directory for your employee identities.

In this step, you will activate a protected free account. You will verify that its administrator controls cover every part of the lab.

In this step, get ready to:

Activate a free Azure account while retaining its spending protection.
Confirm that your subscription has a linked Microsoft Entra ID Free tenant.
Verify your administrator controls for users, groups, and Azure role assignments.

Create your protected free account

The signup runs in Microsoft Edge so your Azure pages can use the same administrator session. Microsoft Entra ID Free is automatically added to the free Azure billing account at no charge.

Keep This Lab Free

Entering card details can feel like a paid commitment. Azure states that free-account customers are not charged unless they choose to move to pay-as-you-go pricing.

Signup requires a phone number plus a non-prepaid credit or debit card. A temporary $1 authorization hold may appear during verification.

Press the Windows key to open Windows search.
Type Microsoft Edge into the search field.
Press Enter to start Microsoft Edge.
Open the Azure free account signup page in Microsoft Edge.
Choose a Microsoft or GitHub account for your signup identity.
Create the chosen account through the signup flow if needed.
Complete the phone verification requested during signup.
Complete the card verification with a non-prepaid credit or debit card.

You will see confirmation that your free Azure account is active. That account becomes the protected home for your IAM lab.

Leave the free-account spending protection in place.
Decline any option to move to pay-as-you-go pricing.
Avoid creating any Azure workload during this setup.

Signup Not Completing?

Confirm that your card is not prepaid.
Confirm that your billing details match the details held by your card provider.
Retry phone verification with a number that can receive the verification request.

Help me troubleshoot my Azure free account signup without sharing private account or card details. Share the non-sensitive symptom with the NextWork community if the issue depends on your account or card provider.

Confirm your subscription and tenant

The Azure portal shows the subscription that holds your resource boundary. The Microsoft Entra admin center shows the tenant that holds your employee identities.

Open the Azure portal in Microsoft Edge.
Sign in with the administrator account used during signup.
Enter Subscriptions in the portal search bar.
Select Subscriptions from the results.

You will see your active free Azure subscription in the list. Its presence confirms that the billing account is ready for the lab.

Open the Microsoft Entra admin center in a new Microsoft Edge tab.
Sign in with the same administrator account.
Select Entra ID from the left navigation.

You will see the Microsoft Entra ID Free tenant linked during Azure signup. The subscription plus tenant now cover both halves of your access model.

Verify your administrator controls

Azure role-based access control manages authorization for Azure resources. The available controls reveal whether your administrator account can manage directory identities plus Azure role assignments.

Switch back to the Microsoft Entra admin center tab.
Select Users under Entra ID.
Confirm that New user is available.
Select Groups under Entra ID.
Select All groups.
Confirm that New group is available.

Those two controls confirm your directory permissions. One final check confirms your Azure resource permissions.

Before this final check, do you expect your signup account to hold every permission this lab needs?

Switch back to the Azure portal tab.
Select your free subscription from Subscriptions.
Select Access control (IAM) from the subscription menu.
Select Add from the toolbar.
Confirm that Add role assignment is enabled.

You will see New user under Users. You will also see New group under All groups.

The subscription IAM page shows an enabled Add role assignment option. This proves that your account can administer the lab from the correct subscription plus tenant.

That is the setup hurdle cleared. Your administrator account can now build the access model without deploying a paid workload.

Your free IAM workspace is ready. Next up, you will create the empty resource group that defines the development access boundary.

Create the Development Access Boundary

Your free account is ready for IAM practice. The next piece is a clear boundary for the employee's future access.

An empty Azure resource group gives Azure RBAC a specific scope without deploying a billable workload. You will create that boundary in the Azure portal.

In this step, get ready to:

Create an empty resource group in your active free subscription.
Confirm the resource group appears in the Azure portal.

Create the resource group

A resource group is a container that defines a boundary for related Azure resources. This boundary gives you a precise scope for the access policy you add later.

Creating a cloud boundary can feel like a billing step. This resource group stays empty, so this step deploys no billable workload.

Switch back to the Azure portal tab in Microsoft Edge.
Select Resource groups.
Select Create.
Choose your active free subscription from the subscription menu.
Enter rg-iam-newhire-lab as the resource group name.
Choose an available region in your geography.
Select Review + Create.

Azure checks the subscription, name, and region before creating the boundary.

Select Create after the review completes.

Good progress. The empty resource group now gives your IAM lab a dedicated access boundary.

Confirm the access boundary

The resource-group list confirms that the boundary exists in the intended subscription. Its Overview page gives you a clear place to apply scoped access later.

Before you refresh the list, which resource group name do you expect to see?

Return to Resource groups in the Azure portal.
Select Refresh.
Find rg-iam-newhire-lab in the resource-group list.
Select rg-iam-newhire-lab.

You will see the resource group's Overview page. This confirms that the empty boundary exists in your active free subscription.

Resource group missing from the list?

Confirm that you are viewing the same active free subscription you selected during creation.
Select Refresh again after the creation process finishes.
Help me troubleshoot a missing Azure resource group.

Your empty access boundary is ready. Next, you will add the identities that eventually receive access.

Create the Employee and Access Group

Your empty rg-iam-newhire-lab resource group gives the lab a clear access boundary. The next piece is the employee identity that eventually needs access.

Microsoft Entra ID stores employee identities. Microsoft Azure applies resource permissions separately.

A security group connects people to a shared permission policy through membership. This separation makes later onboarding changes safer and faster.

In this step, get ready to:

Create an enabled internal member named Avery Support.
Create a security group named gp-rg-readers.
Add Avery Support as a member of gp-rg-readers.

Create Avery's employee identity

The Create new user flow adds an internal member to your tenant. A user principal name combines the username prefix with your tenant domain.

Switch back to the Microsoft Entra admin center tab from earlier.
Select Users under Entra ID.
Select New user.
Select Create new user.
Enter avery.support in User principal name.
Record the full UPN shown in the field as avery.support@<tenant-domain>.

You should now see the tenant domain appended to avery.support in the User principal name field.

Enter Avery Support in Display name.
Keep the auto-generated initial password in Password.

Protect Avery's Initial Password

The auto-generated password is a live credential for Avery's account. Handle it before you finish creating the user.

Store the displayed password in a password manager.
Keep the password out of screenshots and project validations.

Keep Account enabled selected.
Select Review + create.
Review the completed user details.
Select Create.

Good progress. Avery Support now appears in Users with the full UPN you recorded.

Can't Create Avery?

Confirm that Account enabled remains selected.
Return to Users to check whether Avery Support already exists.

Help me troubleshoot Avery's user creation.

Create the access group

An Assigned membership type gives you direct control over who belongs to the group. Keeping Microsoft Entra role assignment off preserves the free path.

Select Groups under Entra ID.
Select All groups.
Select New group.
Choose Security for Group type.
Enter gp-rg-readers in Group name.

The form now identifies gp-rg-readers as a security group.

Choose Assigned for Membership type.
Keep Microsoft Entra roles can be assigned to the group turned off.

The group form should now show Assigned membership with Microsoft Entra role assignability disabled.

Select Create.

Why Use a Group?

A direct user assignment attaches permission to one employee. A group-based assignment attaches policy to the membership list.

Adding or removing a team member changes who inherits that policy. Keeping Microsoft Entra role assignability off also avoids the P1 or P2 requirement for role-assignable groups.

That's the group foundation in place. You should see gp-rg-readers in All groups.

Group Missing?

Confirm that you selected Create after completing the group settings.

Help me find my security group.

Add Avery to the group

Group membership links Avery's identity to the shared access model. It gives you one place to manage who belongs to that model.

Select gp-rg-readers from All groups.
Select Members.
Select + Add members.
Choose Avery Support.
Select Select.

Before you check the member list, which employee do you expect to see inside gp-rg-readers?

Return to Members.

You should see Avery Support with the full UPN avery.support@<tenant-domain>.

You now have one employee identity connected to one reusable access group. That membership is the foundation for the access test ahead.

Avery's identity now sits inside gp-rg-readers. Next, you will test what access this identity structure currently produces at rg-iam-newhire-lab.

Verify the Missing Access

Avery Support now belongs to the gp-rg-readers security group in Microsoft Entra ID. That completes the identity side of your onboarding model.

Next, you will use Check access in the Azure portal to check whether Azure RBAC gives Avery an effective role at the rg-iam-newhire-lab resource group. The result gives you a clean access baseline before any permission is granted.

In this step, get ready to:

Check Avery's effective Azure RBAC access at the resource-group scope.
Confirm that neither Avery nor the group has a role assignment at this scope.

Check Avery's effective access

The Check access pane shows assignments at the selected scope. It also includes assignments inherited from a higher scope.

Switch back to the Azure portal from earlier.
Select Resource groups.
Select rg-iam-newhire-lab.
Select Access control (IAM).

Select the Check access tab.
Select Check access.
Choose User, group, or service principal.
Search for Avery Support.

Before you select Avery, do you think group membership already gives the employee an Azure role at this resource group?

Select Avery Support to reveal the assignments pane.

You'll see no Azure RBAC role for Avery at the rg-iam-newhire-lab scope. This empty result is the intended shortfall.

What Did the Empty Pane Prove?

Microsoft Entra ID knows that Avery belongs to gp-rg-readers. Azure RBAC has no role assignment connecting that security principal to rg-iam-newhire-lab.

Group membership passes along permissions that the group already holds. This group currently holds none at the resource-group scope.

Confirm the group has no role assignment

Avery's assignments pane shows the employee's effective access. The Role assignments list lets you confirm that the group has no assignment at this exact scope.

Return to the Access control (IAM) page for rg-iam-newhire-lab.
Select the Role assignments tab.

Before you search, do you expect either the group or Avery to appear in this list?

Search for gp-rg-readers.

You'll see no matching role assignment for gp-rg-readers at this resource-group scope.

Remove gp-rg-readers from the search field.
Search for Avery Support.

You'll see no matching direct assignment for Avery. You have now proved that neither principal has an Azure RBAC role at rg-iam-newhire-lab.

That baseline is now clear. Next, you'll grant the group the missing read-only permission at this resource-group scope.

Grant and Audit Reader Access

The last check proved that Avery's identity and group membership do not create Azure resource access by themselves. This step connects the existing group to the lab's resource group with Azure role-based access control.

A role assignment connects a security principal to a role at one scope. For this lab, gp-rg-readers receives Reader only at rg-iam-newhire-lab.

You will confirm Avery's resulting read-only access. You will also use the Azure Activity Log to identify the administrator who made the change.

In this step, get ready to:

Assign the Reader role to gp-rg-readers at the resource-group scope.
Verify Avery's effective access through the security group.
Find the successful role-assignment change in the Activity Log.

Assign Reader to the group

The resource-group page fixes the assignment scope before you start. Your free-only guardrail stays intact because this permission change creates no workload.

Return to the Access control (IAM) page for rg-iam-newhire-lab.
Select the Role assignments tab.
Select Add.
Select Add role assignment.

How the Assignment Fits Together

The current resource-group page limits the assignment scope to rg-iam-newhire-lab.
The Reader role supplies read-only permissions.
The gp-rg-readers group passes those permissions to its members.

On the Role tab, choose Reader.
Select Next.
On the Members tab, choose User, group, or service principal.
Select Select members.
Search for gp-rg-readers.
Select gp-rg-readers from the results.
Select Review + assign.

Return to the Role assignments tab.
Locate gp-rg-readers in the assignments list.

You will see one Reader assignment for gp-rg-readers at the rg-iam-newhire-lab scope. That is the access policy live at exactly the boundary you intended.

Reader Assignment Missing?

Refresh the Role assignments tab.
Confirm that gp-rg-readers is the selected principal.
Confirm that the listed role is Reader.

Help me troubleshoot why the Reader assignment is missing from the resource group.

Verify Avery's effective access

Effective access shows the permissions Azure calculates for a principal. Avery should receive Reader through membership in gp-rg-readers.

Before you check Avery, predict where the Reader permission should come from.

Select the Check access tab.
Select Check access on the tab.
Choose User, group, or service principal.
Search for Avery Support.
Select Avery Support.

You will see Reader at rg-iam-newhire-lab through gp-rg-readers. Avery still has no direct Azure RBAC assignment.

Select the Reader role assignment in the assignments pane to open its details.

You will see View all resources, but does not allow you to make any changes.

This confirms Avery can view resources without creating, modifying, or deleting them.

Reader Missing for Avery?

Refresh the Check access tab.
Select Avery Support again.
Return to Role assignments to confirm the group still has Reader.

Help me diagnose why Avery does not receive Reader through the group.

Audit the role assignment

Azure keeps role-assignment changes in the Activity Log for 90 days. A new entry can take a short time to appear, which is normal.

Before you filter the log, predict which account Azure should identify as the caller.

In the rg-iam-newhire-lab menu, select Activity Log.
Set the Event category filter to Administrative.
Set the Operation filter to Create role assignment.
Open the successful Create role assignment event.
Confirm that the event identifies your signed-in administrator account as the caller.

You will see a successful Administrative event for Create role assignment. The caller is the administrator account that created the group assignment.

Activity Log Event Missing?

Refresh Activity Log.
Set Event category to Administrative again.
Set Operation to Create role assignment again.

Help me find the missing role-assignment event in Azure Activity Log.

You have closed the access gap with one group-based Reader assignment at one resource group. Your audit evidence now shows who made the change.

Secret mission

Scale Access with One Group Change

A second employee needs the same read-only view. Add Jordan to the existing group. Then prove that the existing role assignment covers both employees.

Clean Up Your Resources

Your empty Microsoft Azure resource group creates no workload charges. Decide whether to keep the lab available, pause employee access, or delete its resources.

Resources you used:

Azure resources: Your active free subscription and the empty rg-iam-newhire-lab resource group.
Microsoft Entra ID identities: Two enabled internal users named Avery Support and Jordan Support in Microsoft Entra ID.
Group-based access: The gp-rg-readers security group containing both test users.
Azure role assignment: One Azure RBAC assignment granting Reader access to gp-rg-readers at the rg-iam-newhire-lab scope.

Keep everything running

No cleanup action is needed. Choose this if you are still practicing with the lab.

Keep the free-account spending protection active.
Avoid moving the subscription to pay-as-you-go.
Keep rg-iam-newhire-lab empty to avoid deploying billable workloads.
Leave Avery Support, Jordan Support, gp-rg-readers, and its Reader assignment intact for future IAM checks.

Your access model remains ready for another onboarding exercise.

Pause - I'll come back to this later

Pause the lab by removing the group's Reader assignment. This blocks effective resource-group access while preserving the identities and access boundary for later.

In the Azure portal from earlier, select rg-iam-newhire-lab under Resource groups.
Select Access control (IAM).
Select Role assignments.
Check the Reader assignment for gp-rg-readers.
Select Remove.
Select Yes.
Refresh the role assignments list.

You should no longer see the Reader assignment for gp-rg-readers. Avery and Jordan no longer receive access at this scope.

Delete - I don't want to use this again

Remove all project resources and start fresh if you no longer need the lab.

Deleting test identities can feel final. Microsoft Entra ID keeps deleted users restorable for 30 days.

Remove the role assignment:

In the Azure portal from earlier, select rg-iam-newhire-lab under Resource groups.
Select Access control (IAM).
Select Role assignments.
Check the Reader assignment for gp-rg-readers.
Select Remove.
Select Yes.
Refresh the role assignments list.

You should no longer see the Reader assignment for gp-rg-readers.

Delete the test users:

Switch back to the Microsoft Entra admin center from earlier.
Return to Entra ID.
Select Users.
Select Avery Support.
Select Delete user.
Complete the deletion prompt.
Return to Users.
Select Jordan Support.
Select Delete user.
Complete the deletion prompt.
Return to the active users list.
Refresh the users list.

You should no longer see Avery or Jordan in the active users list.

Delete the security group:

Return to Entra ID.
Select Groups.
Select All groups.
Select gp-rg-readers.
Select Delete.
Complete the deletion prompt.
Return to All groups.
Refresh the groups list.

You should no longer see gp-rg-readers in the groups list.

Delete the resource group:

Switch back to the Azure portal from earlier.
Select Resource groups.
Select rg-iam-newhire-lab.
Select Delete resource group.
Complete the portal's confirmation prompt.
Return to the resource-group list.
Select Refresh.

You should no longer see rg-iam-newhire-lab in the resource-group list.

Cancel the subscription if you no longer want Azure:

Select Cost Management + Billing in the Azure portal.
Select Subscriptions or Azure subscriptions.
Choose the active free subscription.
Select Cancel.
Complete Cancel subscription.

Nice Work!

You did it! You built an employee access lab around least privilege.

Avery and Jordan now receive read-only access through one group-based role assignment at rg-iam-newhire-lab. The Azure Activity Log shows which administrator created that assignment.

You've learned how to:

Created enabled employee identities in Microsoft Entra ID. Managed their shared access through the gp-rg-readers security group.
Proved the no-access state before adding an Azure RBAC role assignment. This showed that group membership alone does not authorize access to Azure resources.
Granted the Reader role to gp-rg-readers at rg-iam-newhire-lab. Verified Avery's effective read-only access through Check access. Traced the role-assignment change to your administrator account in the Activity Log.
Secret Mission: Added Jordan Support to gp-rg-readers. Proved Jordan inherited the same Reader access without a direct assignment. The resource group still has exactly one group-based Reader assignment.

Ready to quiz yourself?