If we want to restrict access to the Azure management services for non-privileged users, we can now create a Conditional Access Policy that allows us to do so.
To create a Conditional Access Policy, we’ll need Azure Active Directory Plan 1 or higher, which is either bought standalone, or can be found most notably inside Microsoft 365 Business Premium, or the Microsoft 365 Enterprise plans (E3, E5)
On the other hand, if we just need to restrict access to Azure AD, we have the option to do so from the User Settings in the Azure AD portal:
By creating the following Conditional Access Policy, we will restrict users from accessing these apps:
- Azure portal
- Azure Resource Manager provider
- Classic deployment model APIs
- Azure PowerShell
- Azure CLI
- Azure DevOps
- Azure Data Factory portal
- Azure Event Hubs
- Azure Service Bus
- Azure SQL Database
- SQL Managed Instance
- Azure Synapse
- Visual Studio subscriptions administrator portal
First, open the following link, or go into your Conditional Access Policies:
Conditional Access Policies | Azure AD
Then, under “Users or workload identities“, select all users, and exclude the admin roles you currently use in your organization. You could also create a security group with all admin users as members and then exclude it from the policy.
Under “Cloud apps or actions”, click on “Selected apps”, then “Microsoft Azure Management“.
Finish up by selecting “Block access” under the Grant Access Controls.
From now on, all users except the admins will be blocked from accessing Azure management services.
Azvise 