Skip to content

Azure RBAC Guide#

Creating a group#

Groups will be created via UMAMI. The link to UMAMI can be found below.
UMAMI

Note

You must be on the GP VPN to access the site.

They should follow the below naming convention:

UOM-PS-IT-Azure-{PROJECT_NAME}-{ENV}-{ROLE_NAME}

For example, groups that give reader and contributor access for the Production Staff Portal Platform subscription

UOM-PS-IT-Azure-Staff-Portal-Prod-Reader
UOM-PS-IT-Azure-Staff-Portal-Prod-Contributor

Note

Groups will take an hour to sync from on-premises to Entra

Assigning RBAC rights#

Groups can be used in the RBAC section of your subscription vending YAML data.
Using the property group_name instead of upn will result in looking up the group's object ID.

For example:

name: "UOM-ITS-DDAR-Migration-Test"
cost_code: "P00000"
owner_email: "peter.griffin@manchester.ac.uk"
management_group: "uom-corp"
rbac:
  - group_name: "UOM-PS-IT-Azure-DDAR-Test-Reader"
    definition: "Reader"