Five best Azure Access Control practice
summary
Five concrete Azure fixes: grant access only to AAD security groups so identities don’t become “ghosts and zombies”; use PIM for just‑in‑time elevation (requires AAD P2) instead of permanent rights; create a custom web app slot swapper role that limits production swaps to the specific Microsoft.Web actions (demo finds 627 actions on that provider); prefer managed identities to eliminate connection strings; and run a pipeline where a service principal owns itself to perform self‑rotating secrets (automated rotation works in the demo).
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 3:48Access control challenges
- 10:22Using Azure AD security groups
- 19:44Privileged identity management
- 35:41PIM groups and automation
- 41:30Managed identities
- 46:42Automated deployments
- 50:37Secret rotation and summary
related talks
49mTop 5 ways to secure Azure resources
56mSecuring organizations pipelines and integrations in Azure DevOps Q&A
45mSecuring Identity with Zero Trust
52mDemystifying Web API Security in Azure
51mMeasures for Securing Privileged Users in M365&Azure Every Organization Should Take
41mBuilding better security for your API platform using Azure API Management
19mEnhancing Security in Azure Cosmos DB: Best Practices
49mAzure DevOps security - Lessons learned