Resource based authorization with Azure AD?

Question

Here is the scenario, I have a service containing many records. My service also has many users, each with the ability to create, read, update and delete records. The ability to

Answer 1

As you correctly mention, role based access or authorization is very generic and using that, a user with specific role gets access (or gets denied access) to all resources. (If your sceanrio permits, you could make it a little better by dividing your resources into a few types and give access for 1 or more types of resources to 1 or more roles).

When trying to control access for each record individually, you will need to implement custom logic for resource based authorization. Typically applications utilize a mix of role-based and resource-based authorization driven by their requirements.

In the end it will boil down to a mapping that you need to maintain between 3 things

• Resource (or a collection of resources)
• Azure AD object (like role, group, individual user that is being given permission)
• Permission that you're giving (understood and enforced by your application e.g. Blogs.Create permission for a Blogs application)

Relevant Documentation available on Microsoft Docs

Role-based and resource-based authorization

This documentation talks about similar concepts and shows a good example which makes use of both role based and resource based. CRUD operations on resources based on roles and then special privileges on specific resource for the owner of that resource (i.e. resource based)

Code Samples

1. Multi-tenant Survey Application Code

   Code base for the documentation link above

2. Authorization in a web app using Azure AD groups & group claims

   This one provides a sample task tracker application where users can share tasks with other users or Azure AD groups. Again you will see a mapping between resources (i.e. tasks in this case) and Azure AD objects (i.e. Users or Groups) is being maintained in sample database.

Assigning Application Roles for groups

Since you mentioned this as part of your question, just letting you know that this is possible from Azure Portal but only if you have Azure AD Premium license (I'm not sure which specific ones support it, but search on Group based assignments feature and you'll find it.)