MUA workflow updates

Author: AbhishekMallick-MS

articles/backup/multi-user-authorization-concept.md

@@ -2,7 +2,7 @@
 title: Multi-user authorization using Resource Guard
 description: An overview of Multi-user authorization using Resource Guard.
 ms.topic: conceptual
-ms.date: 09/25/2023
+ms.date: 03/26/2024
 ms.service: backup
 author: AbhishekMallick-MS
 ms.author: v-abhmallick
@@ -54,11 +54,11 @@ Delete backup instance | Optional
 
 The concepts and the processes involved when using MUA for Azure Backup are explained below.
 
-Let’s consider the following two users for a clear understanding of the process and responsibilities. These two roles are referenced throughout this article.
+Let’s consider the following two personas for a clear understanding of the process and responsibilities. These two personas are referenced throughout this article.
 
-**Backup admin**: Owner of the Recovery Services vault or the Backup vault who performs management operations on the vault. To begin with, the Backup admin must not have any permissions on the Resource Guard.
+**Backup admin**: Owner of the Recovery Services vault or the Backup vault who performs management operations on the vault. To begin with, the Backup admin must not have any permissions on the Resource Guard. This can be *Backup Operator* or *Backup Contributor* RBAC role on the Recovery Services vault.
 
-**Security admin**: Owner of the Resource Guard and serves as the gatekeeper of critical operations on the vault. Hence, the Security admin controls permissions that the Backup admin needs to perform critical operations on the vault.
+**Security admin**: Owner of the Resource Guard and serves as the gatekeeper of critical operations on the vault. Hence, the Security admin controls permissions that the Backup admin needs to perform critical operations on the vault. This can be *Backup MUA Admin* RBAC role on the Resource Guard.
 
 Following is a diagrammatic representation for performing a critical operation on a vault that has MUA configured using a Resource Guard.
 
@@ -67,20 +67,22 @@ Following is a diagrammatic representation for performing a critical operation o
 Here's the flow of events in a typical scenario:
 
 1. The Backup admin creates the Recovery Services vault or the Backup vault.
-1. The Security admin creates the Resource Guard. The Resource Guard can be in a different subscription or a different tenant with respect to the vault. It must be ensured that the Backup admin doesn't have Contributor permissions on the Resource Guard.
-1. The Security admin grants the **Reader** role to the Backup Admin for the Resource Guard (or a relevant scope). The Backup admin requires the reader role to enable MUA on the vault.
-1. The Backup admin now configures the vault to be protected by MUA via the Resource Guard.
-1. Now, if the Backup admin wants to perform a critical operation on the vault, they need to request access to the Resource Guard. The Backup admin can contact the Security admin for details on gaining access to perform such operations. They can do this using Privileged Identity Management (PIM) or other processes as mandated by the organization.
-1. The Security admin temporarily grants the **Contributor** role on the Resource Guard to the Backup admin to perform critical operations.
-1. Now, the Backup admin initiates the critical operation.
-1. The Azure Resource Manager checks if the Backup admin has sufficient permissions or not. Since the Backup admin now has Contributor role on the Resource Guard, the request is completed.
+2. The Security admin creates the Resource Guard.
 
-   If the Backup admin didn't have the required permissions/roles, the request would have failed.
+   The Resource Guard can be in a different subscription or a different tenant with respect to the vault. Ensure that the Backup admin doesn't have Contributor permissions on the Resource Guard.
 
-1. The security admin ensures that the privileges to perform critical operations are revoked after authorized actions are performed or after a defined duration. Using JIT tools  [Microsoft Entra Privileged Identity Management](../active-directory/privileged-identity-management/pim-configure.md) may be useful in ensuring this.
+3. The Security admin grants the Reader role to the Backup Admin for the Resource Guard (or a relevant scope). The Backup admin requires the reader role to enable MUA on the vault.
+4. The Backup admin now configures the vault to be protected by MUA via the Resource Guard.
+5. Now, if the Backup admin or any user who has write access to the vault wants to perform a critical operation that is protected with Resource Guard on the vault, they need to request access to the Resource Guard. The Backup Admin can contact the Security admin for details on gaining access to perform such operations. They can do this using Privileged Identity Management (PIM) or other processes as mandated by the organization. They can request for “Backup MUA Operator” RBAC role which allows users to perform only critical operations protected by the Resource Guard and does not allow to delete the resource Guard. 
+6. The Security admin temporarily grants the “Backup MUA Operator” role on the Resource Guard to the Backup admin to perform critical operations.
+7. Then the Backup admin initiates the critical operation.
+8.	The Azure Resource Manager checks if the Backup admin has sufficient permissions or not. Since the Backup admin now has “Backup MUA Operator” role on the Resource Guard, the request is completed. If the Backup admin doesn't have the required permissions/roles, the request will fail.
+9. The Security admin must ensure to revoke the privileges to perform critical operations after authorized actions are performed or after a defined duration. You can use *JIT tools Microsoft Entra Privileged Identity Management* to ensure the same.
 
->[!NOTE]
->MUA provides protection on the above listed operations performed on the vaulted backups only. Any operations performed directly on the data source (that is, the Azure resource/workload that is protected) are beyond the scope of the Resource Guard. 
+
+>[!Note]
+>- If you grant the **Contributor** role on the Resource Guard access temporarily to the Backup Admin, it also provides the delete permissions on the Resource Guard. We recommend you to provide **Backup MUA Operator** permissions only.
+>- MUA provides protection on the above listed operations performed on the vaulted backups only. Any operations performed directly on the data source (that is, the Azure resource/workload that is protected) are beyond the scope of the Resource Guard. 
 
 ## Usage scenarios