You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Authorize access to Azure App Configuration using Microsoft Entra ID
12
-
Besides using Hash-based Message Authentication Code (HMAC), Azure App Configuration supports using Microsoft Entra ID to authorize requests to App Configuration instances. Microsoft Entra ID allows you to use Azure role-based access control (Azure RBAC) to grant permissions to a security principal. A security principal may be a user, a [managed identity](../active-directory/managed-identities-azure-resources/overview.md) or an [application service principal](../active-directory/develop/app-objects-and-service-principals.md). To learn more about roles and role assignments, see [Understanding different roles](../role-based-access-control/overview.md).
12
+
Besides using Hash-based Message Authentication Code (HMAC), Azure App Configuration supports using Microsoft Entra ID to authorize requests to App Configuration instances. Microsoft Entra ID allows you to use Azure role-based access control (Azure RBAC) to grant permissions to a security principal. A security principal may be a user, a [managed identity](../active-directory/managed-identities-azure-resources/overview.md), or an [application service principal](../active-directory/develop/app-objects-and-service-principals.md). To learn more about roles and role assignments, see [Understanding different roles](../role-based-access-control/overview.md).
13
13
14
14
## Overview
15
15
Requests made by a security principal to access an App Configuration resource must be authorized. With Microsoft Entra ID, access to a resource is a two-step process:
16
-
1. The security principal's identity is authenticated and an OAuth 2.0 token is returned. The resource name to request a token is `https://login.microsoftonline.com/{tenantID}` where `{tenantID}` matches the Microsoft Entra tenant ID to which the service principal belongs.
16
+
1. The security principal's identity is authenticated and an OAuth 2.0 token is returned. The resource name to request a token is `https://login.microsoftonline.com/{tenantID}` where `{tenantID}` matches the Microsoft Entra tenant ID to which the service principal belongs.
17
17
2. The token is passed as part of a request to the App Configuration service to authorize access to the specified resource.
18
18
19
-
The authentication step requires that an application request contains an OAuth 2.0 access token at runtime. If an application is running within an Azure entity, such as an Azure Functions app, an Azure Web App, or an Azure VM, it can use a managed identity to access the resources. To learn how to authenticate requests made by a managed identity to Azure App Configuration, see [Authenticate access to Azure App Configuration resources with Microsoft Entra ID and managed identities for Azure Resources](howto-integrate-azure-managed-service-identity.md).
19
+
The authentication step requires that an application request contains an OAuth 2.0 access token at runtime. If an application is running within an Azure entity, such as an Azure Functions app, an Azure Web App, or an Azure VM, it can use a managed identity to access the resources. To learn how to authenticate requests made by a managed identity to Azure App Configuration, see [Authenticate access to Azure App Configuration resources with Microsoft Entra ID and managed identities for Azure Resources](howto-integrate-azure-managed-service-identity.md).
20
20
21
21
The authorization step requires that one or more Azure roles be assigned to the security principal. Azure App Configuration provides Azure roles that encompass sets of permissions for App Configuration resources. The roles that are assigned to a security principal determine the permissions provided to the principal. For more information about Azure roles, see [Azure built-in roles for Azure App Configuration](#azure-built-in-roles-for-azure-app-configuration).
22
22
@@ -28,10 +28,10 @@ When an Azure role is assigned to a Microsoft Entra security principal, Azure gr
28
28
## Azure built-in roles for Azure App Configuration
29
29
Azure provides the following Azure built-in roles for authorizing access to App Configuration data using Microsoft Entra ID:
30
30
31
-
-**App Configuration Data Owner**: Use this role to give read/write/delete access to App Configuration data. This does not grant access to the App Configuration resource.
32
-
-**App Configuration Data Reader**: Use this role to give read access to App Configuration data. This does not grant access to the App Configuration resource.
33
-
-**Contributor** or **Owner**: Use this role to manage the App Configuration resource. It grants access to the resource's access keys. While the App Configuration data can be accessed using access keys, this role does not grant direct access to the data using Microsoft Entra ID. This role is required if you access the App Configuration data via ARM template, Bicep, or Terraform during deployment. For more information, see [deployment](quickstart-deployment-overview.md).
34
-
-**Reader**: Use this role to give read access to the App Configuration resource. This does not grant access to the resource's access keys, nor to the data stored in App Configuration.
31
+
-**App Configuration Data Owner**: Use this role to give read/write/delete access to App Configuration data. This role doesn't grant access to the App Configuration resource.
32
+
-**App Configuration Data Reader**: Use this role to give read access to App Configuration data. This role doesn't grant access to the App Configuration resource.
33
+
-**Contributor** or **Owner**: Use this role to manage the App Configuration resource. It grants access to the resource's access keys. While the App Configuration data can be accessed using access keys, this role doesn't grant direct access to the data using Microsoft Entra ID. This role is required if you access the App Configuration data via ARM template, Bicep, or Terraform during deployment. For more information, see [deployment](quickstart-deployment-overview.md).
34
+
-**Reader**: Use this role to give read access to the App Configuration resource. This role doesn't grant access to the resource's access keys, nor to the data stored in App Configuration.
35
35
36
36
> [!NOTE]
37
37
> After a role assignment is made for an identity, allow up to 15 minutes for the permission to propagate before accessing data stored in App Configuration using this identity.
Copy file name to clipboardExpand all lines: articles/azure-app-configuration/howto-disable-access-key-authentication.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Disable access key authentication for an Azure App Configuration instance
3
3
titleSuffix: Azure App Configuration
4
-
description: Learn how to disable access key authentication for an Azure App Configuration instance
4
+
description: Learn how to disable access key authentication for an Azure App Configuration instance.
5
5
ms.service: azure-app-configuration
6
6
author: jimmyca15
7
7
ms.author: jimmyca
@@ -17,7 +17,7 @@ When you disable access key authentication for an Azure App Configuration resour
17
17
18
18
## Disable access key authentication
19
19
20
-
Disabling access key authentication will delete all access keys. If any running applications are using access keys for authentication they will begin to fail once access key authentication is disabled. Enabling access key authentication again will generate a new set of access keys and any applications attempting to use the old access keys will still fail.
20
+
Disabling access key authentication will deletes all access keys. If any running applications are using access keys for authentication, they will begin to fail once access key authentication is disabled. Enabling access key authentication again will generate a new set of access keys and any applications attempting to use the old access keys will still fail.
21
21
22
22
> [!WARNING]
23
23
> If any clients are currently accessing data in your Azure App Configuration resource with access keys, then Microsoft recommends that you migrate those clients to [Microsoft Entra ID](./concept-enable-rbac.md) before disabling access key authentication.
@@ -29,7 +29,7 @@ To disallow access key authentication for an Azure App Configuration resource in
29
29
1. Navigate to your Azure App Configuration resource in the Azure portal.
30
30
2. Locate the **Access settings** setting under **Settings**.
31
31
32
-
:::image type="content" border="true" source="./media/access-settings-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources access key blade":::
32
+
:::image type="content" border="true" source="./media/access-settings-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources access key blade.":::
33
33
34
34
3. Set the **Enable access keys** toggle to **Disabled**.
35
35
@@ -43,7 +43,7 @@ The capability to disable access key authentication using the Azure CLI is in de
43
43
44
44
### Verify that access key authentication is disabled
45
45
46
-
To verify that access key authentication is no longer permitted, a request can be made to list the access keys for the Azure App Configuration resource. If access key authentication is disabled there will be no access keys and the list operation will return an empty list.
46
+
To verify that access key authentication is no longer permitted, a request can be made to list the access keys for the Azure App Configuration resource. If access key authentication is disabled, there will be no access keys, and the list operation will return an empty list.
47
47
48
48
# [Azure portal](#tab/portal)
49
49
@@ -52,7 +52,7 @@ To verify access key authentication is disabled for an Azure App Configuration r
52
52
1. Navigate to your Azure App Configuration resource in the Azure portal.
53
53
2. Locate the **Access settings** setting under **Settings**.
54
54
55
-
:::image type="content" border="true" source="./media/access-settings-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources access key blade":::
55
+
:::image type="content" border="true" source="./media/access-settings-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources access key blade.":::
56
56
57
57
3. Verify there are no access keys displayed and **Enable access keys** is toggled to **Disabled**.
58
58
@@ -68,7 +68,7 @@ az appconfig credential list \
68
68
--resource-group <resource-group>
69
69
```
70
70
71
-
If access key authentication is disabled then an empty list will be returned.
71
+
If access key authentication is disabled, then an empty list will be returned.
72
72
73
73
```
74
74
C:\Users\User>az appconfig credential list -g <resource-group> -n <app-configuration-name>
Copy file name to clipboardExpand all lines: articles/azure-app-configuration/quickstart-bicep.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
26
26
27
27
## Authorization
28
28
29
-
Managing an Azure App Configuration resource with Bicep file requires an Azure Resource Manager role, such as contributor or owner. Accessing Azure App Configuration data (key-values, snapshots) requires an Azure Resource Manager role and addtional an Azure App Configuration [data plane role](concept-enable-rbac.md) when the configuration store's ARM authentication mode is set to [pass-through](./quickstart-deployment-overview.md#arm-authentication-mode) ARM authentication mode.
29
+
Managing an Azure App Configuration resource with Bicep file requires an Azure Resource Manager role, such as contributor or owner. Accessing Azure App Configuration data (key-values, snapshots) requires an Azure Resource Manager role and an additional Azure App Configuration [data plane role](concept-enable-rbac.md) when the configuration store's ARM authentication mode is set to [pass-through](./quickstart-deployment-overview.md#arm-authentication-mode) ARM authentication mode.
Copy file name to clipboardExpand all lines: articles/azure-app-configuration/quickstart-deployment-overview.md
+15-13Lines changed: 15 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,22 +31,22 @@ To learn more about Azure RBAC and Microsoft Entra ID, see [Authorize access to
31
31
32
32
## Manage Azure App Configuration data in deployment
33
33
34
-
Azure App Configuration data, such as key-values and snapshots, can be managed in deployment. When managing App Configuration data using this method, it is recommended to set your configuration store's ARM authentication mode to **Pass-through**. This ensures that data access requires a combination of data plane and ARM management roles as well as ensuring that data access can be properly attributed to the deployment caller for auditing purpose.
34
+
Azure App Configuration data, such as key-values and snapshots, can be managed in deployment. When managing App Configuration data using this method, it's recommended to set your configuration store's Azure Resource Manager authentication mode to **Pass-through**. This authentication mode ensures that data access requires a combination of data plane and Azure Resource Manager management roles and ensuring that data access can be properly attributed to the deployment caller for auditing purpose.
35
35
36
-
### ARM authentication mode
36
+
### Azure Resource Manager authentication mode
37
37
38
38
# [Azure portal](#tab/portal)
39
39
40
-
To configure the ARM authentication mode of an Azure App Configuration resource in the Azure portal, follow these steps:
40
+
To configure the Azure Resource Manager authentication mode of an Azure App Configuration resource in the Azure portal, follow these steps:
41
41
42
42
1. Navigate to your Azure App Configuration resource in the Azure portal
43
43
2. Locate the **Access settings** setting under **Settings**
44
44
45
-
:::image type="content" border="true" source="./media/access-settings-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources access settings blade":::
45
+
:::image type="content" border="true" source="./media/access-settings-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources access settings blade.":::
46
46
47
47
3. Select the recommended **Pass-through** authentication mode under **Azure Resource Manager Authentication Mode**
48
48
49
-
:::image type="content" border="true" source="./media/quickstarts/deployment/select-passthrough-authentication-mode.png" alt-text="Screenshot showing pass-through authentication mode being selected under Azure Resource Manager Authentication Mode":::
49
+
:::image type="content" border="true" source="./media/quickstarts/deployment/select-passthrough-authentication-mode.png" alt-text="Screenshot showing pass-through authentication mode being selected under Azure Resource Manager Authentication Mode.":::
50
50
51
51
---
52
52
@@ -55,7 +55,7 @@ To configure the ARM authentication mode of an Azure App Configuration resource
55
55
56
56
### Azure App Configuration Authorization
57
57
58
-
When your App Configuration resource has its ARM authentication mode set to **Pass-through**, you must have Azure App Configuration data plane permissions to read and manage Azure App Configuration data in deployment. This is in addition to baseline management permission requirements of the resource. Azure App Configuration data plane permissions include Microsoft.AppConfiguration/configurationStores/\*/read and Microsoft.AppConfiguration/configurationStores/\*/write. Built-in roles with this action include:
58
+
When your App Configuration resource has its Azure Resource Manager authentication mode set to **Pass-through**, you must have Azure App Configuration data plane permissions to read and manage Azure App Configuration data in deployment. This requirement is in addition to baseline management permission requirements of the resource. Azure App Configuration data plane permissions include Microsoft.AppConfiguration/configurationStores/\*/read and Microsoft.AppConfiguration/configurationStores/\*/write. Built-in roles with this action include:
59
59
60
60
- App Configuration Data Owner
61
61
- App Configuration Data Reader
@@ -67,27 +67,29 @@ To learn more about Azure RBAC and Microsoft Entra ID, see [Authorize access to
67
67
When an App Configuration resource is restricted to private network access, deployments accessing App Configuration data through public networks will be blocked. To enable successful deployments when access to an App Configuration resource is restricted to private networks the following actions must be taken:
68
68
69
69
-[Azure Resource Management Private Link](../azure-resource-manager/management/create-private-link-access-portal.md) must be set up
70
-
- The App Configuration resource must have ARM authentication mode set to **Pass-through**
71
-
- The App Configuration resource must have ARM private network access enabled
72
-
- Deployments accessing App Configuration data must run through the configured ARM private link
70
+
- The App Configuration resource must have Azure Resource Manager authentication mode set to **Pass-through**
71
+
- The App Configuration resource must have Azure Resource Manager private network access enabled
72
+
- Deployments accessing App Configuration data must run through the configured Azure Resource Manager private link
73
73
74
74
If all of these criteria are met, then deployments accessing App Configuration data will be successful.
75
75
76
76
# [Azure portal](#tab/portal)
77
77
78
-
To enable ARM private network access for an Azure App Configuration resource in the Azure portal, follow these steps:
78
+
To enable Azure Resource Manager private network access for an Azure App Configuration resource in the Azure portal, follow these steps:
79
79
80
80
1. Navigate to your Azure App Configuration resource in the Azure portal
81
81
2. Locate the **Networking** setting under **Settings**
82
82
83
-
:::image type="content" border="true" source="./media/networking-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources networking blade":::
83
+
:::image type="content" border="true" source="./media/networking-blade.png" alt-text="Screenshot showing how to access an Azure App Configuration resources networking blade.":::
0 commit comments