4.4 Custom Roles, Overprivileged Access, Backup & IaC Security

4.4 Custom Roles, Overprivileged Access, Backup & IaC Security

Quick Answer: Create custom Azure roles only when built-ins are too broad or too narrow for ARM resource actions; create custom Entra roles only for directory tasks. Continuously hunt overprivileged Owner/Contributor and wildcard assignments. Protect Recovery Services / Backup vaults with soft delete, immutability, and multi-user authorization (MUA). Ship infrastructure with Bicep/ARM/Terraform using policy, secure parameters, and secrets outside templates.

Custom Azure roles vs custom Microsoft Entra roles

Authoring a custom Azure role (security engineer view)

1. Start from the closest built-in role JSON.
2. Trim to required Actions / DataActions; avoid * unless break-glass.
3. Use NotActions carefully—they subtract from Actions but are easy to misunderstand; explicit allow lists are clearer when possible.
4. Set assignable scopes to the management groups/subscriptions where the role may be used—do not make every custom role tenant-wide without need.
5. Test with a pilot identity; verify both positive access and that denied actions still fail.
6. Prefer PIM-eligible assignment for any privileged custom role.

Scenario: Ops needs to restart App Service plans and read logs but must not change networking or assign roles. A custom role with Microsoft.Web restart/read actions at the app RG is better than Contributor on the subscription.

Custom Entra roles (brief, in-scope)

SC-500 mentions managing custom roles including Azure roles and Microsoft Entra roles. For Entra customs:

• Use when built-in directory roles (Application Administrator, Groups Administrator, etc.) are too wide.
• Still subject to Privileged Identity Management, Conditional Access, and access reviews.
• Never substitute an Entra custom role for Azure Key Vault secret get permissions—that is the wrong plane.

Least privilege and overprivileged access

Least privilege: grant the minimum role at the minimum scope for the minimum time.

Evaluating overprivileged assignments (exam + real life)

How to review:

1. Inventory role assignments at MG, subscription, RG, and resource scopes (Azure Resource Graph / IAM downloads / access reviews).
2. Expand group membership (nested groups hide Owners).
3. Check Azure AD / Entra privileged roles that can elevate into Azure (for example Global Admin elevating access to manage all Azure subscriptions).
4. Correlate with PIM candidate roles still permanently active.
5. Fix by removing, replacing with narrower roles, lowering scope, or converting to eligible PIM assignments.

Defender for Cloud / identity recommendations and Microsoft Entra access reviews are allies here; governance is not only Policy.

Azure Backup security features

Backups are a prime ransomware target: attackers delete vaults, purge recovery points, or disable protection. SC-500 expects security controls on backup—not merely “enable backup.”

Soft delete

Soft delete retains deleted backup items (and, with modern secure-by-default behavior, strengthens vault-level protection) for a retention window so you can undelete after accidental or malicious deletion.

Immutability

Immutable vaults prevent operations that would destroy recovery guarantees—such as removing backups or reducing retention in ways that erase recovery points before policy expiry. Once immutability is locked/enforced per vault capabilities, even privileged administrators cannot “quietly” shrink protection to sabotage recovery.

Use immutability for high-value workloads and regulated data. Plan carefully: operational flexibility drops by design.

Multi-user authorization (MUA) and Resource Guard

MUA adds a second approver boundary for critical backup operations using a Resource Guard typically in a separate subscription or security admin boundary:

• Disabling soft delete / security features
• Stopping protection with delete
• Changing MUA itself
• Other critical vault operations Microsoft protects with MUA

Roles such as Backup MUA Admin (manage Resource Guard) and Backup MUA Operator (perform guarded operations with authorization) appear in Azure built-in roles. Pattern: backup operators work daily in the workload subscription; security team owns Resource Guard elsewhere so a single compromised admin cannot both delete backups and disable defenses.

Other backup security reminders

• Use private endpoints / restricted network access to vaults where architecture allows.
• Encrypt with customer-managed keys when policy requires; protect those keys with Key Vault purge protection (chapter 3).
• Soft delete and immutability complement resource locks but are not identical—locks protect ARM resources; backup soft delete protects recovery data lifecycle.
• Hybrid MARS/MABS/DPM scenarios have additional security PIN and critical-operation notifications; cloud VM backup focuses on vault soft delete/immutability/MUA.

Infrastructure as code (IaC) security

SC-500 explicitly includes implementing security controls by using infrastructure as code. IaC is how guardrails scale with deployments.

Tooling surface

Secure IaC practices for the exam

1. No secrets in templates or repos — use Key Vault references, GitHub OIDC / Azure DevOps federated credentials, pipeline secret stores; never commit storage keys or client secrets.
2. Secure parameters — mark secure parameters in ARM/Bicep (secure()); avoid echoing secrets in deployment logs/outputs.
3. Policy as code — deploy Azure Policy assignments/initiatives from the same pipelines that deploy landing zones; fail PRs that introduce public endpoints or missing encryption.
4. What-if / plan before apply — review destructive changes; require approvals for prod.
5. Least-privilege deployment identity — deployment service principal gets only the roles needed at the target scope (often scoped Contributor + specialized roles, not tenant Owner).
6. Deploy locks, diagnostic settings, Private Link, and CMK options in the template so environments are born compliant (pair with Deny policies for defense in depth).
7. Terraform state — remote state in Azure Storage with encryption, RBAC, soft delete, and no public access; state can contain sensitive values.
8. Deployment stacks / deny assignments — when using stacks to manage resources, understand platform deny assignments that protect managed resources from unauthorized deletion outside the stack.

Scenario: A pipeline deploys a Key Vault and App Service. The Bicep module enables RBAC permission model, purge protection, private endpoint, and diagnostic settings; secrets are set in a post-deploy step using a managed identity that has only Secrets Officer on that vault. A Policy Deny blocks any later manual portal change that re-enables public network access.

Tying the governance chapter together

Exam traps

• Building a custom Entra role when the need is Azure data-plane access (or vice versa).
• Using custom roles with * “for convenience.”
• Disabling backup soft delete to “clean up faster” without MUA/security review.
• Storing Terraform state or parameter files with secrets in a public storage container.
• Assuming resource locks alone provide backup immutability.

If you can design least-privilege roles, prove who is overprivileged, harden vaults against malicious purge, and ship secure templates, you have closed the SC-500 governance skill area.