Azure Portal Access Management
Access management in the Azure portal is the discipline of controlling who can reach Azure resources and what they may do with them. Its foundation is Azure role-based access control (Azure RBAC), an authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources[^c1]. Under RBAC, permissions are enforced exclusively through role assignments: access is granted by creating an assignment that binds a security principal, a role definition, and a scope, and access is revoked by removing it[^c2].
The Azure portal is the primary surface for putting this model into practice. The Access control (IAM) page is where administrators assign roles to grant access to Azure resources[^c3], and it appears at every level of the resource hierarchy — management groups, subscriptions, resource groups, and individual resources. Microsoft Entra ID (formerly Azure Active Directory) supplies the identities those assignments target, including users, groups, service principals, and managed identities. The machinery is not static: through 2026 Microsoft continued to add narrowly scoped built-in roles such as the A365 Gateway Policy Operator[^c20], retired or realigned legacy Entra roles, and extended governance so that eligible and active Azure role assignments at management group, subscription, and resource group scope can be managed directly through entitlement management access packages[^c19].
Securing portal access reaches beyond RBAC into sign-in security. Conditional Access lets administrators implement automated access-control decisions for cloud apps based on conditions such as location, device, and risk[^c6], while multi-factor authentication (MFA) protects the portal's sign-in itself. Microsoft has made MFA mandatory for all Azure sign-ins, rolled out in phases from the second half of 2024: enforcement for the Azure portal, the Microsoft Entra admin center, and the Intune admin center began in October 2024[^c11][^c10], and the requirement later extended to the Azure CLI, PowerShell, and infrastructure-as-code tooling[^c8]; service principals, managed identities, and other workload identities used for automation are excluded from the enforcement[^c9]. A further phase requires MFA for all Azure portal access from October 1, 2026, including for Global Administrators[^c14]. On tenants of the Microsoft Entra ID Free tier, security defaults (see [[Security Defaults]]) provide this MFA protection at no license cost, including for the Azure portal[^c12][^c13]. For privileged identities, Privileged Identity Management limits the time when highly privileged roles are active and restricts them to a specific group of users[^c4]; under its current model, eligible administrators activate roles only when needed, provide verification or justification, wait for approval when configured, and receive time-limited privileges[^c15].
Two developments in 2026 reshaped the operational picture. The classic subscription administrator roles — legacy Service Administrator and Co-Administrator roles inherited from the Azure Service Manager era — are fully retired as of May 2026, and the Classic Administrators tab has been removed from the Azure portal[^c16], leaving RBAC role assignments as the only way to manage subscription access. In identity governance, user-centric Access Reviews reached general availability, letting a reviewer see every resource one user can access inside a single review instead of running separate reviews per group or per application[^c17], and Microsoft Entra Tenant Governance became generally available for discovering shadow tenants and enforcing least-privilege baselines across Entra, Intune, Exchange, Teams, Purview, and Defender[^c18]. Access reviews and regular audits prevent standing access from accumulating, and emergency access (break-glass) accounts — high-privilege, cloud-only accounts — provide a fallback path for regaining entry during identity outages or Conditional Access lockouts[^c5]. Together these mechanisms form a governance model built on least privilege.