|
| 1 | +This guided project consists of the following exercises: |
| 2 | + |
| 3 | + - **Create user and group** |
| 4 | + - Assign RBAC role at scope |
| 5 | + - Verify least-privilege model |
| 6 | + |
| 7 | +In this exercise, you create a security group, a new user account, and add the user to the group. This sets up the identity foundation that you assign permissions to in the next exercise. |
| 8 | + |
| 9 | +This exercise includes the following tasks: |
| 10 | + |
| 11 | + - Prepare the environment |
| 12 | + - Create a test storage account |
| 13 | + - Create the security group |
| 14 | + - Create the user account |
| 15 | + - Add the user to the group |
| 16 | + |
| 17 | +**Outcome:** A new user account and security group are ready for access assignment. |
| 18 | + |
| 19 | +> [!TIP] |
| 20 | +> Pause after each major action and confirm the page status before moving on. This habit prevents compounding mistakes. |
| 21 | +
|
| 22 | +## Task 1: Prepare the environment |
| 23 | + |
| 24 | +Set up your Azure environment before you begin. You create a resource group and a test resource as a safe sandbox for practicing access control. |
| 25 | + |
| 26 | +> [!WARNING] |
| 27 | +> This project creates Azure resources that may incur charges. Complete the clean-up unit when you're done to avoid unintended expenses. |
| 28 | +
|
| 29 | +1. Sign in to the [Azure portal](https://portal.azure.com) with an account that can manage users and role assignments. |
| 30 | +2. In the portal search bar, search for **Resource groups** and select **Resource groups**. |
| 31 | +3. Select **+ Create**. Name the resource group **rg-gp-access-model**, choose your preferred region, and select **Review + create** then **Create**. |
| 32 | + |
| 33 | +## Task 2: Create a test storage account |
| 34 | + |
| 35 | +Create a storage account inside the resource group. This resource provides a scope for your RBAC role assignments. |
| 36 | + |
| 37 | +1. In the portal search bar, search for **Storage accounts** and select **Storage accounts**. |
| 38 | +2. Select **+ Create**. |
| 39 | +3. On the Basics tab, select **rg-gp-access-model** as the resource group. |
| 40 | +4. For **Storage account name**, enter a globally unique name (for example, **stgpaccessmodel** followed by your initials and a number). |
| 41 | +5. For **Region**, use the same region as the resource group. |
| 42 | +6. For **Preferred Storage Type**, select **Azure Blob Storage or Azure Data Lake Storage Gen 2**. |
| 43 | +7. For **Performance**, select **Standard**. |
| 44 | +8. For **Redundancy**, select **Locally-redundant storage (LRS)**. |
| 45 | +9. Select **Review + create** and then select **Create**. |
| 46 | +10. When deployment finishes, select **Go to resource**. |
| 47 | + |
| 48 | +## Task 3: Create the security group |
| 49 | + |
| 50 | +Set up a security group that serves as a container for your new user. Using groups makes permission management scalable—you assign permissions once to a group, then add or remove users as needed. |
| 51 | + |
| 52 | +1. In the portal search bar, search for **Microsoft Entra ID** and select **Microsoft Entra ID**. |
| 53 | +2. In the left menu under **Manage**, select **Groups**. |
| 54 | +3. Select **New group**. |
| 55 | +3. For **Group type**, select **Security**. |
| 56 | +4. For **Group name**, enter **gp-rg-readers**. |
| 57 | +5. For **Group description**, enter **Readers for the guided project resource group**. |
| 58 | +6. Select **Create**. |
| 59 | + |
| 60 | +> [!NOTE] |
| 61 | +> **Validation step:** Verify the **gp-rg-readers** security group now exists in your tenant. |
| 62 | +
|
| 63 | +> [!NOTE] |
| 64 | +> Each exercise includes validation steps like this one. Track your results as you go—you'll review them all in the validation unit at the end of this module. |
| 65 | +
|
| 66 | +## Task 4: Create the user account |
| 67 | + |
| 68 | +Create a new identity in Entra ID for the team member. This user account will be added to the security group, inheriting all permissions assigned to that group. |
| 69 | + |
| 70 | +1. In the portal search bar, search for **Microsoft Entra ID** and select **Microsoft Entra ID**. |
| 71 | +2. In the left menu under **Manage**, select **Users**. |
| 72 | +3. Select **New user** and then select **Create new user**. |
| 73 | +4. For **User principal name **, enter a unique name (for example, **alexgp **). This is the sign-in name the user would use to access Azure (combined with your tenant domain, it becomes something like **[email protected]**). Record this value—you need it for later validation. |
| 74 | +5. For **Display name**, enter **Alex Guided Project**. |
| 75 | +6. Select **Review + create** and then select **Create**. |
| 76 | +7. The Users list may not refresh automatically. Select **Refresh** to confirm the new user appears in the list. |
| 77 | + |
| 78 | +> [!NOTE] |
| 79 | +> **Validation step:** Confirm the new user account is created. Record the user principal name (UPN) for later validation. |
| 80 | +
|
| 81 | +## Task 5: Add the user to the group |
| 82 | + |
| 83 | +Complete the group membership by adding the new user. This establishes the connection between the user and the group, so the user now inherits all RBAC permissions assigned to the group. |
| 84 | + |
| 85 | +1. In the Users list, select the checkbox to the left of **Alex Guided Project**. |
| 86 | +2. In the horizontal menu at the top, select **Edit**. |
| 87 | +3. Select **Add to group**. |
| 88 | +4. Search for and select **gp-rg-readers**, then select **Select**. |
| 89 | + |
| 90 | +> [!NOTE] |
| 91 | +> **Validation step:** Confirm the user is now a member of **gp-rg-readers**. Any RBAC permissions assigned to this group will apply to all members. |
0 commit comments