{ "id": "b6838a2a-29b2-4bdb-b60b-3f750c17bba4", "name": "Configure RBAC for a Resource Group", "slug": "configure-rbac-for-a-resource-group", "status": "published", "lab_type": "azure", "is_sample": false, "duration_in_seconds": 1200, "metadata": {}, "session": null, "company": "a491bc32-c056-4946-9169-cc053387bada", "created": "2020-08-11T12:14:09.224868Z", "modified": "2023-10-03T18:58:58.870343Z", "is_beta": false, "lab_objectives": [], "main_learning_area": null, "learning_areas": [], "categories": [], "tags": [], "difficulty": null, "is_web_access": false, "is_lab_experience": false, "is_featured": false, "cve": null, "severity": null, "year": null, "classification": null, "is_trackable": false, "cpe_credits": null, "is_skill_check": false, "external_url": "https://portal.azure.com/", "solution_video": "360b3f84-858f-4feb-8fe8-3baf2d60838a", "explanation_video": null, "description": "# Task: Configure RBAC for a Resource Group\r\n\r\n## Video: Role-Based Access Control\r\n\r\n**Estimated time:** 10 minutes\r\n\r\n## Goal\r\n\r\nThe goal of this task is to verify the actions permitted a user with limited roles. This includes assigning resource group and resource level roles to a user, and verifing the permissions of that user.\r\n\r\n## Pre-requisites\r\n\r\n1. Non-production Azure subscription\r\n2. Resource group named **task-rbac-rg**\r\n3. Several resources in the **task-rbac-rg** resource group\r\n4. An Azure AD cloud user named **tasks** for testing access\r\n\r\n## Requirements\r\n\r\n1. Requirement 1: Assign resource group roles\r\n2. Requirement 2: Assign resource roles\r\n\r\n## Pre-requisite setup\r\n\r\nFor this task, you will need to start with a resource group named **task-rbac-rg**. The resource group should contain the following resources:\r\n\r\n1. A route table named **rbac-rt**\r\n2. A network security group (NSG) named **rbac-nsg**\r\n3. A virtual network named **rbac-vnet**\r\n4. A Standard_D2S_V3 VM named **rbac-vm** using the Ubuntu 18.04 marketplace image, on the default subnet of the **rbac-vnet** virtual network\r\n5. A test user named **tasks** in your Azure AD tenant\r\n\r\nYou can deploy the resources to your subscription by running the following from a bash cloud shell:\r\n\r\n```bash\r\ncurl https://inedemoassets.blob.core.windows.net/taskfiles/azure_admin/deploy-3509T060-pre.sh | sh\r\n```\r\n\r\nYou can create a new Azure AD user from the bash cloud shell by running the following command (substitute your values for the domain name and password):\r\n\r\n```bash\r\naz ad user create --display-name tasks --password --user-principal-name tasks@ --force-change-password-next-login false\r\n```\r\n\r\nExample\r\n\r\n```bash\r\naz ad user create --display-name tasks --password B@dPa55word! --user-principal-name tasks@inedemos.onmicrosoft.com --force-change-password-next-login false\r\n```\r\n\r\n## Requirement 1: Assign resource group roles\r\n\r\nFor this requirement you will assign roles on the **task-rbac-rg** resource group to the **tasks** Azure AD cloud user and verify their permissions. Perform the following steps to complete this requirement:\r\n\r\n- Assign the **Reader** role to the **tasks** user on the **task-rbac-rg** resource group.\r\n- Assign the **Network-Contributor** role to the **tasks** user on the **task-rbac-rg** resource group.\r\n- Open an incognito/private browser window and log in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) as the tasks user.\r\n- Assign the **rbac-nsg** network security group to the **Subnet-1** subnet of the **rbac-vnet** virtual network.\r\n- Attempt to stop the **rbac-vm** virtual machine.\r\n- Close the incognito/private browser window.\r\n\r\n## Requirement 2: Assign resource roles\r\n\r\nFor the requirement you will assign the **Contributor** role on the **rbac-vm** virtual machine to the **tasks** Azure AD cloud user. You will then log in to the Azure portal and attempt to stop the virtual machine. To complete this requirement:\r\n\r\n- Assign the **Contributor** role to the **tasks** user on the **rbac-VM** virtual machine.\r\n- Open an incognito/private browser window and log in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) as the tasks user.\r\n- Attempt to stop the **rbac-vm** virtual machine.\r\n- Close the incognito/private browser window.\r\n\r\n## Cleanup\r\n\r\nWhen you have completed this task, delete the **task-rbac-rg** resource group.\r\n", "description_html": "

Task: Configure RBAC for a Resource Group

\n

Video: Role-Based Access Control

\n

Estimated time: 10 minutes

\n

Goal

\n

The goal of this task is to verify the actions permitted a user with limited roles. This includes assigning resource group and resource level roles to a user, and verifing the permissions of that user.

\n

Pre-requisites

\n
    \n
  1. Non-production Azure subscription
    2. \n
  2. Resource group named task-rbac-rg
    3. \n
  3. Several resources in the task-rbac-rg resource group
    4. \n
  4. An Azure AD cloud user named tasks for testing access
    5. \n
\n

Requirements

\n
    \n
  1. Requirement 1: Assign resource group roles
    2. \n
  2. Requirement 2: Assign resource roles
    3. \n
\n

Pre-requisite setup

\n

For this task, you will need to start with a resource group named task-rbac-rg. The resource group should contain the following resources:

\n
    \n
  1. A route table named rbac-rt
    2. \n
  2. A network security group (NSG) named rbac-nsg
    3. \n
  3. A virtual network named rbac-vnet
    4. \n
  4. A Standard_D2S_V3 VM named rbac-vm using the Ubuntu 18.04 marketplace image, on the default subnet of the rbac-vnet virtual network
    5. \n
  5. A test user named tasks in your Azure AD tenant
    6. \n
\n

You can deploy the resources to your subscription by running the following from a bash cloud shell:

\n
curl https://inedemoassets.blob.core.windows.net/taskfiles/azure_admin/deploy-3509T060-pre.sh | sh
\n\n

You can create a new Azure AD user from the bash cloud shell by running the following command (substitute your values for the domain name and password):

\n
az ad user create --display-name tasks --password <your password> --user-principal-name tasks@<your domain> --force-change-password-next-login false
\n\n

Example

\n
az ad user create --display-name tasks --password B@dPa55word! --user-principal-name tasks@inedemos.onmicrosoft.com --force-change-password-next-login false
\n\n

Requirement 1: Assign resource group roles

\n

For this requirement you will assign roles on the task-rbac-rg resource group to the tasks Azure AD cloud user and verify their permissions. Perform the following steps to complete this requirement:

\n\n

Requirement 2: Assign resource roles

\n

For the requirement you will assign the Contributor role on the rbac-vm virtual machine to the tasks Azure AD cloud user. You will then log in to the Azure portal and attempt to stop the virtual machine. To complete this requirement:

\n\n

Cleanup

\n

When you have completed this task, delete the task-rbac-rg resource group.

", "tasks": "", "tasks_html": "", "published_date": "2020-04-07T18:00:00Z", "solutions": "", "solutions_html": "", "flags": [], "min_points_to_pass": null, "access_type": "default", "user_status": "unstarted", "user_lab_status": null, "user_status_modified": null, "user_flags": [] }