Azure Portal Access Management
Access management in the Azure portal is the discipline of controlling who can reach Azure resources and what they may do with them. Its foundation is Azure role-based access control (Azure RBAC), an authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources[^c1]. Under RBAC, permissions are enforced exclusively through role assignments: access is granted by creating an assignment that binds a security principal, a role definition, and a scope, and access is revoked by removing it[^c2].
The Azure portal is the primary surface for putting this model into practice. The Access control (IAM) page is where administrators assign roles to grant access to Azure resources[^c3], and it appears at every level of the resource hierarchy — management groups, subscriptions, resource groups, and individual resources. Microsoft Entra ID (formerly Azure Active Directory) supplies the identities those assignments target, including users, groups, service principals, and managed identities.
Securing portal access reaches beyond RBAC into sign-in security. Conditional Access lets administrators implement automated access-control decisions for cloud apps based on conditions such as location, device, and risk[^c6], while multi-factor authentication (MFA) protects the portal's sign-in itself. Microsoft has made MFA mandatory for all Azure sign-ins, rolled out in phases from the second half of 2024: enforcement for the Azure portal, the Microsoft Entra admin center, and the Intune admin center began in October 2024[^c11][^c10], and the requirement later extended to the Azure CLI, PowerShell, and infrastructure-as-code tooling[^c8]; service principals, managed identities, and other workload identities used for automation are excluded from the enforcement[^c9]. On tenants of the Microsoft Entra ID Free tier, security defaults provide this MFA protection at no license cost, including for the Azure portal[^c12][^c13]. For privileged identities, Privileged Identity Management limits the time when highly privileged roles are active and restricts them to a specific group of users[^c4]. Access reviews and regular audits prevent standing access from accumulating, and emergency access (break-glass) accounts — high-privilege, cloud-only accounts — provide a fallback path for regaining entry during identity outages or Conditional Access lockouts[^c5]. Together these mechanisms form a governance model built on least privilege.