Finding the right Azure administrators can be a daunting task, especially if you're new to the cloud. Azure administrators are responsible for managing and maintaining Azure resources, ensuring they are secure, scalable, and running efficiently.
In order to find the best Azure administrators, you can start by checking the official Azure website, which lists certified professionals who have passed the Microsoft Certified: Azure Administrator Associate exam.
Having a certified Azure administrator on board can significantly boost your cloud productivity, saving you time and resources in the long run.
Azure Administrator List
To find the list of Azure administrators, you can use the Azure portal, PowerShell, or Microsoft 365 admin center. You can also use Microsoft Entra admin center to download a CSV file detailing role assignment for users.
To view all roles and see what users or groups are assigned to the roles, log in to the Azure portal, go to Azure Active Directory and click on Roles and Administrators.
You can use the Azure AD PowerShell for Graph or Azure Active Directory Module for Windows PowerShell (MSOnline) to manage administrator roles in Azure Active Directory using PowerShell.
If you want to list all assigned Azure Administrator Roles, you can use a script that formats the output nicely with the "real" Role name instead of the Guid.
To list all users with a specific Azure Administrator Role, you can use the Get-MsolRoleMember cmdlet, which lists members of a given role using RoleObjectId to identify the Role GUID.
To list all Azure Administrator Roles for a specific user, you can add some filtering to the output by replacing the last line of code in the previous script with the following.
You can also use the Microsoft 365 admin center to export all the users assigned with admin roles by clicking on 'Export admin list' at the top of the page.
Here is a list of ways to find the Azure Administrator list:
- Azure portal: Go to Azure Active Directory and click on Roles and Administrators.
- Azure AD PowerShell for Graph: Use the Get-MsolRoleMember cmdlet to list members of a given role.
- Microsoft 365 admin center: Click on 'Export admin list' at the top of the page to export all the users assigned with admin roles.
- Microsoft Entra admin center: Download a CSV file detailing role assignment for users.
- PowerShell script: Use a script that formats the output nicely with the "real" Role name instead of the Guid.
Managing Azure Portal
To manage Azure administrators, you can use the Azure Portal. Log in to the Azure Portal to access the necessary tools.
To view all roles and see what users or groups are assigned to the roles, go to Azure Active Directory and click on Roles and Administrators. This will give you a comprehensive list of all roles and their assignments.
To view what roles are assigned to an individual user, go to Users, select the user, and click Assigned Roles. This will show you the specific roles assigned to that user.
Azure User Management
To view all roles and see what users or groups are assigned to the roles, log in to the Azure Portal, go to Azure Active Directory and click on Roles and Administrators. This is a straightforward way to get an overview of who has admin roles in your Azure environment.
You can also use the Azure portal to list and manage privileged administrator role assignments. To do this, click on the specific resource, then click Access control (IAM), and finally, click the Role assignments tab and then click the Privileged tab.
To view what roles are assigned to an individual user, go to Users, select the user, and click Assigned Roles. This will give you a clear picture of the admin roles held by each user.
PowerShell is another powerful tool for managing Azure administrator roles. You can use either Azure AD PowerShell for Graph or Azure Active Directory Module for Windows PowerShell (MSOnline) to achieve this.
Here's a step-by-step guide to using the Azure portal to list all Azure administrator roles for a specific user:
1. Log in to the Azure Portal.
2. Go to Azure Active Directory.
3. Click on Roles and Administrators.
4. Select the user you're interested in.
5. Click Assigned Roles.
Alternatively, you can use PowerShell to list all Azure administrator roles for a specific user. You can use the following script to achieve this:
Note: This script requires you to replace the last line of code with the following:
Azure Security and Monitoring
Monitoring local admin access on Azure AD joined Windows PCs is possible by running Kusto queries on Log Analytics data. This allows for insights into the usage of local admin accounts.
You can render the data as graphics and include it in reports. This makes it easier to visualize and share the information with others.
Kusto queries, such as the one that maps Accountname to devicename, can be adapted to fit your specific environment. This means you can easily find users logging on as local admin on multiple devices.
Azure Productivity and Guidelines
Managing admin roles in Azure is a crucial aspect of maintaining a secure and organized Microsoft 365 organization. You can use PowerShell to manage Entra ID admin roles, which proves to be a powerful and efficient method.
To start, you'll need to execute the command `Get-MgBetaDirectoryRole` to check the admin roles in Microsoft 365. Before running the cmdlet, make sure to install Microsoft Graph PowerShell.
Assigning a user with admin role involves running the cmdlet `New-MgRoleManagementDirectoryRoleAssignment` with the required parameters, including `DirectoryScopeId`, `RoleDefinitionId`, and `PrincipalId`. Replace the placeholders with the actual role definition ID and user object ID.
Removing a user from an admin role can be done using the `Remove-MgDirectoryRoleMemberByRef` cmdlet, specifying the `DirectoryRoleId` and `DirectoryObjectId`. Replace the placeholders with the actual role definition ID and user object ID.
To check whether a user has been assigned with admin roles, execute the command `Get-MgDirectoryRoleMemberAsUser` with the `DirectoryRoleId` parameter. Replace the placeholder with the actual admin role you want to report.
Regular review of admin roles is essential to maintaining a strong and secure Microsoft 365 organization. Utilize AdminDroid's default alert policy template to receive alerts on Users Removed from Admin Roles and simplify the task for Microsoft 365 admins.
Here's a summary of the PowerShell cmdlets used to manage admin roles:
Azure Centralized Visibility and Control
To gain centralized visibility into admins, you can use the Microsoft Entra Admin Center. Login to the Microsoft Entra admin center to access this feature.
Monitoring and managing Microsoft 365 users with admin access is crucial for maintaining control. You can set up a quick schedule to stay informed about admin users.
To download a CSV file detailing role assignment for users, select 'Download assignments' in the Microsoft Entra admin center. This will help you keep track of admin roles and assignments.
AdminDroid Permission is required to access this feature in the Microsoft Entra admin center.
Here's a quick rundown of the steps to download the CSV file:
- Login to the Microsoft Entra admin center.
- Navigate to Identity»Roles & admins.
- Select Roles & admins to list all admin roles.
- Select 'Download assignments' to download the CSV file.
Sources
- https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-portal
- https://www.easy365manager.com/azure-administrator-roles/
- https://admindroid.com/how-to-get-admin-roles-report-in-microsoft-365
- https://help.desk365.io/en/articles/configure-user-consent-for-applications-in-azure-ad/
- https://skotheimsvik.no/five-approaches-for-local-admin-access-on-the-azure-ad-joined-pc
Featured Images: pexels.com