Azure contributor access from Visual Studio

0
votes

As security best practice our Client has restricted developer roles to Contributor on their Azure Portal resource group. All is fine but this seriously restricts using any kind of azure integration (deployments, server explorer, cloud explorer etc) from Visual Studio if we use the Contributor role to sign in to azure from Visual Studio. We are working on typical MSBI services like data lake analytics (usql), azure Analysis services, dw. And we cannot use any of the visual studio azure connectivity features.

I found a solution, to use a management cert. But MS site warns against using this as it will allow access to all azure resources defeating the purpose of contributor restrictions.

Could I please request for any guidance?

1
visual-studioazurerbac
Why not just have the client create a Resource Group configured for you, for dev/test purposes, with appropriate access privileges? Not sure what else you can do, if the client locked you out, aside from running your own Azure subscription for dev/test. - David Makogon
Client created a resource group and provided access with RBAC. However to work with Visual Studio we need to have a subscription which you do not get unless you are associated as a subscription admin/co-admin. I stand corrected if I am wrong on this. I believe MS had created the RBAC concept to fine tune access management - so you could give ownership to subsections where users could have complete ownership. However if this prevents using visual studio on that area then I am mistaken about the model. Perhaps use VSTS that gets code from VControl and then uses higher role to deploy to azure? - shaswata pal

1 Answers

0
votes

You can use RBAC'd accounts with VS, only the "legacy" features will not recognize them - e.g. Cloud Service Publish, Server Explorer (for this use Cloud Explorer instead).

Anything recent (AzureRM Tools, Cloud Explorer, Web Tools, Connected Svcs, Team Explorer) will work with RBAC

What features are you having trouble with?