I would like to give it as many privileges as possible, but I'm confused as how to do it.
#How to give App Registration admin privileges?
twilit snow
I want the Azure equivalent of creating an AWS IAM user with the AdministratorAccess role that I intend to use for programmatic access
prime solar
Global Admin
It's a bad idea to grant that excess of privileges to an entity
Least privilege should espescially apply to entities that are used in programmatic access, since they are not always hit by Conditional Access Policies
plucky cairn
It's a bad idea to grant that excess of privileges to an entity
its not only a bad idea, its a good way to get breached, GA is golden keys to the silver city
unique wave
I would like to give it as many privileges as possible, but I'm confused as how ...
why?
twilit snow
because this is a brand new subscription with nothing in it, and I need to be able to do anything with TF to iterate quickly
prime solar
Global Admin' scope is also Entra ID/Azure AD so you'll be god mode there too (all users/all domains, all admin panels) if it exists in M365 or Azure you'll own it
Azure Resources RBAC it's 'god'-mode is "Owner", which you'll also don't want to utilize if not explicitly required
plucky cairn
Azure Resources RBAC it's 'god'-mode is "Owner", which you'll also don't want to...
well GA can easily escalate to user access admin to root so its basically god mode in azure too
prime solar
@plucky cairn that's why I said if it exists in M365 or Azure 😄