So, you’ve got your Azure subscription in place, and you’re the global administrator. Now you want to let someone else access your subscription, but only a specific resource group within your subscription. In this blog post, I’ll show you how to add a new user to your Azure subscription’s directory, and how to then grant permission for that user to a specific resource group within your Azure subscription that they can manage. The new user won’t be able to see or manage any resources in your subscription outside the resource group that you grant them access for.
Let’s get started. First, log in to the Azure portal and open your subscription’s directory. To do this, search for directory and choose Azure Active Directory, as follows:
Next, take note of the directory name; this is the domain name for the email address of the users you can create in this directory. It will be based on your username, followed by .onmicrosoft.com. In my case, with username email@example.com, the directory name is lennilhotmail.onmicrosoft.com.
Now click on Users:
You will see your username listed. Now click New user:
In the User blade, supply information for the new user. This includes the display name and the username. The username must be in the form of an email address, where the domain name matches the directory name.
Also check Show Password to view the auto-generated password so that you can send it to the new user (the portal will require that they change it the first time they log in).
Here I’m creating a new user for my buddy Andrew Brust:
At this point, I have created a new user for Andrew:
When Andrew logs in for the first time, he will be required to change his password. The login will succeed, but he won’t be able to see anything in the subscription until we grant him access to a specific resource group. Let’s do that next.
Click Resource groups, then select the resource group you want to give the user access to. Here I’m giving Andrew access to the sql-demo-rg resource group:
Next, click Access control (IAM):
We need to add the new user to this resource group. So click Add:
From the Role dropdown, select Owner. Then click on the new user and click Save:
This will make the new user an Owner over the entire resource group so that they can fully manage all the resources inside that group (and they can also create new resources inside the resource group). They will still have no access to any other resources in any other resource groups across your subscription.
You’re done! The new user now has full access to the resource group (and can’t see anything else) on the subscription.
To confirm, go back to the Active Directory blade for the new user and click Azure resources:
Here you can see that Andrew has Owner access to the sql-demo-rg resource group, but no access to anything else in the subscription.
In this blog post, I showed you how to create a new user to your Azure subscription directory, and how to grant Owner permissions for that user to a specific resource group in the subscription. Hope you all find this useful!