In this module, the Kladde has gotten identities and roles: for the app, for the group Kladde-Operations, and soon for the pipeline and the worker too. Every role is a door. This lesson checks whether every door stands open only as far as it has to, and gets a second opinion for that: Microsoft Defender for Cloud reads the Kladde’s resource group and says what it would do differently.

Four questions for every role

Least privilege means: Every identity may do exactly what its task requires, and no more. Four questions show whether a role meets that:

  1. What exactly? A data role instead of a management role. Whoever needs to read values from Key Vault gets Key Vault Secrets User, not Contributor and never Owner. Contributor may change and delete resources, Owner may also assign roles.
  2. Where exactly? The smallest scope that works: the resource instead of the resource group, the resource group instead of the subscription. A role on the subscription also applies to everything that gets created there tomorrow.
  3. Who exactly? A group instead of a person, an identity of its own per app instead of a shared one. Whoever leaves the team loses all permissions by leaving the group, without anyone having to go through a list.
  4. For how long? Permissions for people that are rarely needed shouldn’t be assigned permanently. Microsoft Entra Privileged Identity Management grants a role on request for a limited time; it needs an Entra ID P2 license and is only a preview for the Kladde. For a small group, the rule is: Owner only for the person who is responsible for the subscription, and even they work with less in everyday use.

There’s also a rule that’s easily overlooked: Data plane permissions aren’t only in Azure. The database has users and roles of its own (lesson 3.3.1), and a db_owner role there is as broad as Owner on the subscription.