Hello there and thank you very much for joining us
today in these new Azure Portal How-To Video. Today we
learn how to view delegated resource groups in Azure
Lighthouse in the Azure Portal and for that we have
George Enninful, who's going to show us how to do that.
So, thank you very much for joining us today, George.
Thank you very much, Leon.
Hello, my name is George Enninful. I’m a Program
Manager on the Portal team for Azure Lighthouse and
Azure Arch for Service. In this episode of the Azure Portal
How-To Series, you will learn how to view delegated
resource groups and
subscriptions in Azure Lighthouse.
You will also get an introduction
of the Azure Lighthouse’s
integration with Azure Active Directory privileged identity
management. Let’s head over to the Azure Portal to
get started.
Let’s see it, let’s go.
So if you haven’t used Azure Lighthouse before, you
can search for Azure Lighthouse in the global search and
then once you’ve used it,
you’ll find it in the list of recently
used services the next time you go there. So, clicking on it
navigates you to the Azure Lighthouse landing page.
So, Azure Lighthouse allows customers to delegate their
resource groups and
subscriptions to service providers
who can perform additional management tasks on them
based on roles that have been assigned to them. So to
view the delegations assigned to your resource providers,
you click on view service provider button.
And you’re relegated to the service provider overview page.
So on this page, to view your delegations, you can either
click on delegations in the
left or you can click on the view
delegations button below.
So on the delegations blade, we group your resource
groups and subscriptions under the different service
providers that you’re working with. So, for example,
Fabrikam Managed Services has the list of subscriptions
below, whereas the Relecloud Managed Services has a
mix of resource groups and subscriptions delegated to
them. So, let’s click on one of the role assignments to view
the details.
So over here, we can see the details of the role assignment.
We’re showing you the
description of the offer of what the
service provider will be giving you, and we also show you
the subscription that you’ve delegated to them. We’ll head
over to the role assignments tab to view details of the role
assignments. So, on this tab, we show on Tier 1 support,
which is a group that consists of many members. So, all
the members in this group will have access to the list of
roles on this page. So, for example, the reader role allows
the service providers to view all resources but does not
allow them to make any changes, whereas the contributor
role grants them full access to manage all resources but
does not allow them to assign roles in Azure RBAC, manage
assignments in Azure Blueprint, or share image galleries.
We also show you the different access types in Azure
Lighthouse. We have the permanent roles and eligible
roles. Originally, Azure Lighthouse
only supported permanent
roles, but with the integration with Azure Active Directory
privileged identity management, we’re also supporting
eligible roles. Eligible roles have many benefits that
permanent roles do not have. Eligible roles are activated
just on a just-in-time basis. We have an maximum
activation duration of eight hours. You can require your
service provider to use
multifactor authentication in Azure
and then once the role expires, they can reactivate.
They can also require that the eligible roles have an approver
workflow associated or not. So if you click on this approver
link here, we show you the
list, the details of the approver’s
for this delegation. So,
essentially, the integration of Azure
Active Directory privileged identity management with Azure
Lighthouse aligns with the Zero Trust security strategy,
which uses the principle of least privilege and it adds an
extra layer of security when others are accessing
your environment.
Thank you very much, George. It was great.
And thanks, every one of
you, for watching. Please try this
out. Let us know what you think. Leave us a comment in
the comment section, follow us on Twitter. And thanks
again for watching. Look
forward to seeing you in the next
video. Bye for now.
Bye.