0

As per below link, we can assign Global Administrator or Security Administrator role in Azure AD to an user and that provides full access to Microsoft Cloud App Security portal. https://learn.microsoft.com/en-us/cloud-app-security/manage-admins#office-365-and-azure-ad-roles-with-access-to-cloud-app-security However, with these roles users get privileged admin access to other features of Azure AD as well. We want restrict the role to provide full access in Microsoft Cloud App Security portal only. Is it possible to create a custom role with permissions only for Microsoft Cloud App Security?

Subhajit Dey
  • 3
  • 2

2 Answers2

0

Unfortunately it's not supported to create a custom AAD role with the full access permission of Microsoft Cloud App Security portal.

Currently, permissions for Application registrations and Enterprise applications are supported in custom roles. See the details here.

The full access permission of Microsoft Cloud App Security portal should be microsoft.directory/cloudAppSecurity/allProperties/allTasks. You can see that it's not listed in the page when I try to look for it in Azure portal.

enter image description here

You can query microsoft.directory/cloudAppSecurity/allProperties/allTasks in this page and choose the one with the least permissions to assign to users who need to be assigned the Cloud App Security portal administrator role.

Allen Wu
  • 15,529
  • 1
  • 9
  • 20
  • Although your answer is correct as per the documentation, I couldn't find this permission in out Azure AD tenant while creating a custom role with this permission microsoft.directory/cloudAppSecurity/allProperties/allTasks – Subhajit Dey May 03 '21 at 07:35
  • @SubhajitDey Yes. As I said, you can only select a built-in role which includes `microsoft.directory/cloudAppSecurity/allProperties/allTasks`, not create a custom role which includes it. – Allen Wu May 03 '21 at 07:38
0

Recently Microsoft has came up with a new role named "Cloud App Security Administrator". This role provides full admin access to MCAS without providing any privileged access other Azure AD configurations. Didn't find any documentation, but it is visible in Azure AD portal.

Subhajit Dey
  • 3
  • 2