Hide some resources in Resource group except one AD group

Question

I have a scenario where I need to restrict access to a specific Azure resource to only one Azure Active Directory (AD) group. Here's the setup:

Environment Details:

The resources are deployed in a shared Resource Group (RG). Role assignments are applied at the subscription level, so they are inherited by all resources in the RG.

Current Setup:

The subscription has role assignments for Group1, Group2, and Group3, granting them access to all resources in the RG. The RG is shared between two projects: One of the projects has sensitive data and includes a specific storage account named "testhrweuo1".

Goal:

I want to restrict access to the "testhrweuo1" storage account so that only Group1 can see or access it (i.e., members of Group2 and Group3 should not have any visibility or access to this resource).

Issue:

Because the role assignments are inherited from the subscription level, all three groups currently have access to the storage account. I am looking for a way to override this inheritance and restrict the visibility or access to only Group1.

Answer 1

Note that: At the subscription level, you cannot restrict access to a specific resource.

• Role assignments at the subscription level are inherited by all resources within that subscription, including all Resource Groups and their resources.
• This means if you assign a role at the subscription level, it applies to all resources within that subscription and cannot restrict it to a specific resource.

The subscription-level role assignments do not have the ability to be scoped further to a single resource, in your scenario only the "testhrweuo1" storage account or even to a specific Resource Group. They apply to everything in the subscription unless overridden at a lower level (Resource Group or resource).

I want to restrict access to the "testhrweuo1" storage account so that only Group1 can see or access it (i.e., members of Group2 and Group3 should not have any visibility or access to this resource).

To restrict access to the "testhrweuo1" storage account:

1. Remove access for Group2 and Group3 at the subscription level and assign roles separately for Group2 and Group3 at either the Resource Group level or Resource level (depending on where you want them to have access).
2. Assign a role for Group1 to ensure they have access to the "testhrweuo1" storage account. You can assign the role at the Resource Group level, Resource level, or Subscription level (if you want Group1 to access all resources).

Resource Group level role assignment:

Go to the Resource Group in the Azure portal, select Access control (IAM), click + Add → Add role assignment, choose the appropriate role, select the user/group (e.g., Group1), and click Save.

Resource level role assignment:

On the storage account page, go to Access control (IAM), click + Add → Add role assignment, choose the appropriate role (e.g., Storage Blob Data Contributor), search and select Group1, then click Save.