Roles and Permissions

Introduction

An organisation can contain any number of employees or external contractors as users of its Turbo360 account to manage and monitor the associated services.

Not all employees or contractors of an organisation can be granted authorization to execute all activities on Turbo360-managed applications. Depending on the features and configurations of the applications, an organisation may require many access restrictions. An account with too many permissions is vulnerable to security breaches.

Turbo360's fine-grained access control is aided by a user access policy with personalised function capability.

The first user who signs up for Turbo360 will be given the role of Account Owner, which grants them full access to the account. That user can add an unlimited number of users to Azure Documenter (here after referred to as "module") and assign them any system or user-defined roles.

Managing roles

System-defined roles

Azure Documenter (hereafter referred to as "module") has three system-defined roles, and can contain any number of user-defined roles. The System-defined roles are:

1) Owner
2) Contributor
3) Reader

Owner has complete access to the module, including managing users and roles in that module. No other role other than Account owner and Owner of the module can manage users and roles.

Contributor has access to manage everything at the scope at which it is assigned.

Reader has access to read everything at the scope at which it is assigned.

What is Scope?

• The scope of a role determines at which level in the module, a user has permissions that are specified for that role. The scope of a role in Azure Documenter can be any of the two levels given below:

  1. Entire module
  2. Document configuration

The below screenshot shows the list of users having access to a document configuration Contoso production.

From the Scope column in the screenshot above, it is clear that the second user has got access to this application because that user is an account owner (Having complete access to Turbo360). The first and third user has got access to this application because that user was directly assigned a role to access this document configuration.

User-defined roles

• Account owners and owners of the module can add any number of roles to the module. A user-defined role is used to specify permissions in the context of document configuration. In simple terms, it determines who can do what in a document configuration.

• A user-defined role contains two set of permissions: Management permissions, Feature permissions and Resource permissions.

  1. Management permissions comprises of the user management permission that allows users to manage users and their permissions. The role creator can choose if this role can contain either read-only or manage permission on user management.

  2. Feature permissions comprises of a set of Azure features such as Document configuration management, Policy management and Azure Diagrams. The role creator can choose if this role can contain either read-only or manage permission on these features.

• For example, if a group of users needs to generate a document but shouldn't be able to do anything else that the features of a document configuration allow, a role can be created with only access permissions to features related to document generation and assigned to those users.

• A role can be added by selecting Add role option under Roles tab. A role must include a name and an optional description, followed by feature permissions.

• A user-defined role can be removed any time by clicking the Delete role option in the Actions column under Roles tab. Before deleting, a replacement role must be provided to replace the role of all users who have been assigned the role that is about to be deleted. As a result, users will not lose access to the module at any scope to which the previous role was assigned.

System vs User-defined roles

• As mentioned above, user-defined roles are used to specify permissions in the context of document configuration. Performing operations on top of a document configuration, such as deleting the document configuration, managing service principals in the module requires at least a Contributor role.

• For example, if a user is a good fit for managing a document configuration set up for testing but not for managing the document configuration set up for production, that user can be assigned a Contributor role for testing configuration, and any other suitable role with restricted permissions for production configuration. If a user is a good fit for managing the entire module (for example, a team lead), but not for managing users and their roles, that user can be assigned a Contributor role across the module.

Export user details with permissions

Users can export Turbo360 account details, along with their user permissions, in a CSV format, which allows them to view the permissions provided to each user at various levels within the account.