You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#customer intent: As a platform engineer, I want to configure a managed identity for a dev center so that I can enable secure deployment for my development teams.
11
13
---
12
14
13
15
# Configure a managed identity for a dev center
@@ -18,24 +20,29 @@ Azure Deployment Environments uses managed identities to give development teams
18
20
19
21
The managed identity attached to a dev center should be [assigned both the Contributor role and the User Access Administrator role](#assign-a-subscription-role-assignment) in the deployment subscriptions for each environment type. When an environment deployment is requested, the service grants appropriate permissions to the deployment identities that are set up for the environment type to deploy on behalf of the user. The managed identity attached to a dev center also is used to add to a [catalog](how-to-configure-catalog.md) and access [environment definitions](configure-environment-definition.md) in the catalog.
20
22
23
+
## Prerequisites
24
+
25
+
- A [dev center](how-to-create-configure-dev-center.md).
26
+
21
27
## Add a managed identity
22
28
23
29
In Azure Deployment Environments, you can choose between two types of managed identities:
24
30
25
31
-**System-assigned identity**: A system-assigned identity is tied either to your dev center or to the project environment type. A system-assigned identity is deleted when the attached resource is deleted. A dev center or a project environment type can have only one system-assigned identity.
26
32
-**User-assigned identity**: A user-assigned identity is a standalone Azure resource that you can assign to your dev center or to a project environment type. For Azure Deployment Environments, a dev center or a project environment type can have only one user-assigned identity.
27
33
28
-
As a security best practice, if you choose to use user-assigned identities, use different identities for your project and for your dev center. Project identities should have more limited access to resources compared to a dev center.
34
+
As a security best practice, if you choose to use user-assigned identities, use different identities for your project and for your dev center. Project identities should have more limited access to resources than dev centers.
29
35
30
36
> [!NOTE]
31
37
> In Azure Deployment Environments, if you add both a system-assigned identity and a user-assigned identity, only the user-assigned identity is used.
32
38
33
39
### Add a system-assigned managed identity
34
40
35
41
1. Sign in to the [Azure portal](https://portal.azure.com) and go to Azure Deployment Environments.
36
-
1. On **Dev centers**, select your dev center.
37
-
1. On the left menu under **Settings**, select **Identity**.
38
-
1. Under **System assigned**, set **Status** to **On**.
42
+
1. In the left menu, select **Dev centers**.
43
+
1. On the **Dev centers** page, select your dev center.
44
+
1. In the left menu, under **Settings**, select **Identity**.
45
+
1. On the **System assigned** tab, set **Status** to **On**.
39
46
1. Select **Save**.
40
47
41
48
:::image type="content" source="media/configure-managed-identity/configure-system-assigned-managed-identity.png" alt-text="Screenshot that shows the system-assigned managed identity." lightbox="media/configure-managed-identity/configure-system-assigned-managed-identity.png":::
@@ -45,9 +52,10 @@ As a security best practice, if you choose to use user-assigned identities, use
45
52
### Add a user-assigned managed identity
46
53
47
54
1. Sign in to the [Azure portal](https://portal.azure.com) and go to Azure Deployment Environments.
48
-
1. On **Dev centers**, select your dev center.
49
-
1. On the left menu under **Settings**, select **Identity**.
50
-
1. Under **User assigned**, select **Add** to attach an existing identity.
55
+
1. In the left menu, select **Dev centers**.
56
+
1. On the **Dev centers** page, select your dev center.
57
+
1. On the left menu, under **Settings**, select **Identity**.
58
+
1. On the **User assigned** tab, select **Add** to attach an existing identity.
51
59
52
60
:::image type="content" source="media/configure-managed-identity/configure-user-assigned-managed-identity.png" alt-text="Screenshot that shows the user-assigned managed identity." lightbox="media/configure-managed-identity/configure-user-assigned-managed-identity.png":::
53
61
@@ -59,25 +67,25 @@ As a security best practice, if you choose to use user-assigned identities, use
59
67
60
68
## Assign a subscription role assignment
61
69
62
-
The identity attached to the dev center should be assigned the Contributor and User Access Administrator roles for all the deployment subscriptions and the Reader role for all subscriptions that contain the relevant project. When a user creates or deploys an environment, the service grants appropriate access to the deployment identity that's attached to the project environment type. The deployment identity uses the access to perform deployments on behalf of the user. You can use the managed identity to empower developers to create environments without granting them access to the subscription.
70
+
The identity attached to the dev center should be assigned the Contributor and User Access Administrator roles for all the deployment subscriptions and the Reader role for all subscriptions that contain the relevant project. When a user creates or deploys an environment, the service grants appropriate access to the deployment identity that's attached to the project environment type. The deployment identity uses the access to perform deployments on behalf of the user. You can use the managed identity to enable developers to create environments without granting them access to the subscription.
63
71
64
72
### Add a role assignment to a system-assigned managed identity
65
73
66
74
1. In the Azure portal, navigate to your dev center in Azure Deployment Environments.
67
-
1.On the left menu under **Settings**, select **Identity**.
75
+
1.In the left menu, under **Settings**, select **Identity**.
68
76
1. Under **System assigned** > **Permissions**, select **Azure role assignments**.
69
77
70
78
:::image type="content" source="media/configure-managed-identity/system-assigned-azure-role-assignment.png" alt-text="Screenshot that shows the Azure role assignment for system-assigned identity." lightbox="media/configure-managed-identity/system-assigned-azure-role-assignment.png":::
71
79
72
-
1. To give Contributor access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
80
+
1. To grant Contributor access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
73
81
74
82
|Name |Value |
75
83
|---------|----------|
76
84
|**Scope**|Subscription|
77
85
|**Subscription**|Select the subscription in which to use the managed identity.|
78
86
|**Role**|Contributor|
79
87
80
-
1. To give User Access Administrator access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
88
+
1. To grant User Access Administrator access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
81
89
82
90
|Name |Value |
83
91
|---------|----------|
@@ -88,18 +96,18 @@ The identity attached to the dev center should be assigned the Contributor and U
88
96
### Add a role assignment to a user-assigned managed identity
89
97
90
98
1. In the Azure portal, navigate to your dev center.
91
-
1.On the left menu under **Settings**, select **Identity**.
99
+
1.In the left menu, under **Settings**, select **Identity**.
92
100
1. Under **User assigned**, select the identity.
93
-
1.On the left menu, select **Azure role assignments**.
94
-
1. To give Contributor access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
101
+
1.In the left menu, select **Azure role assignments**.
102
+
1. To grant Contributor access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
95
103
96
104
|Name |Value |
97
105
|---------|----------|
98
106
|**Scope**|Subscription|
99
107
|**Subscription**|Select the subscription in which to use the managed identity.|
100
108
|**Role**|Contributor|
101
109
102
-
1. To give User Access Administrator access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
110
+
1. To grant User Access Administrator access to the subscription, select **Add role assignment (Preview)**, enter or select the following information, and then select **Save**:
103
111
104
112
|Name |Value |
105
113
|---------|----------|
@@ -119,7 +127,7 @@ You can set up your key vault to use either a [key vault access policy](/azure/k
119
127
If the key vault is configured to use a key vault access policy:
120
128
121
129
1. In the Azure portal, go to the key vault that contains the secret with the personal access token.
122
-
1.On the left menu, select **Access policies**, and then select **Create**.
130
+
1.In the left menu, select **Access policies**, and then select **Create**.
123
131
1. On **Create an access policy**, enter or select the following information:
124
132
125
133
1. On the **Permissions** tab, under **Secret permissions**, select the **Get** checkbox, and then select **Next**.
@@ -131,8 +139,8 @@ If the key vault is configured to use a key vault access policy:
131
139
If the key vault is configured to use Azure role-based access control:
132
140
133
141
1. In the Azure portal, go to the key vault that contains the secret with the personal access token.
134
-
1.On the left menu, select **Access control (IAM)**.
135
-
1. Select the identity, and in the left menu, select **Azure role assignments**.
142
+
1.In the left menu, select **Access control (IAM)**.
143
+
1. Select the identity, and, in the left menu, select **Azure role assignments**.
136
144
1. Select **Add role assignment**, and then enter or select the following information:
0 commit comments