如何限制Azure安全组的删除？
是否可以制定任何Azure策略，可以将用户重新降低，以便他们 无法删除Azure中的任何安全组？即使他们可以将角色降低到低于角色：
- 用户管理
- 特权Auth Admin
- Apchindation Admin
- Adminal Adminage Admin
- 私有角色管理员
- 身份治理管理Admin
- Security Admin
感谢。
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
•目前，均无法应用这种策略，以防止Azure 中的安全组删除。但是，有一种方法可以通过在Azure中分配的Azure AD角色来防止安全组删除。为此，您将必须确保您不会分配诸如“用户管理员，特权身份验证管理员等”之类的Azure AD内置角色。直接将这些角色的默认权限分配给了您的Azure AD租户中的任何用户或一组用户。
然后，
根据您的特定要求创建自定义Azure AD角色，仅使用所需的权限，如文档链接中所述： -https://learn.microsoft.com/en-us/azure/role--role/role-cost-costom-access-access-costom-costom-custom--custom--custom--------角色
或您认为正确的一组用户。但是，请确保 'Microsoft.directory/groups/delete'''''''''''Microsoft.directory/accessreviews/definitions.groups/delete'权限未分配给创建的任何自定义PIM角色，并且也无法分配分配分配的权限 内置的Azure AD角色向任何用户提供了
在特权身份管理下， 您可以限制PIM和其他自定义角色或默认角色的用户，也许就是这样，以防止在Azure 中删除任何安全组。
• For now, no such policy can be applied that prevents security group deletion in Azure. But there is a way through which you can prevent security group deletion through assigned Azure AD roles in Azure. For this purpose, you will have to ensure that you don’t assign Azure AD built-in roles like ‘User Administrator, Privileged authentication administrator, etc.’ directly with the default assigned permissions to these roles to any of the user or a group of users in your Azure AD tenant.
Then,
create custom Azure AD roles according to your specific requirement with the required permissions onlyas described in the documentation link as below: -https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles
https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-create
• Once the custom required Azure PIM specific roles are created, then assign these PIM roles to the required users or a group of users as you deem correct. But do ensure that ‘microsoft.directory/groups/delete’ and ‘microsoft.directory/accessReviews/definitions.groups/delete’ permissions are not assigned to any of these custom PIM roles created and also bar from assigning the built-in Azure AD roles under Privileged Identity Management to any of the users, as these permissions only give the assigned role/user the rights to delete a security group.
In this way,
you can restrict the users of PIM and other custom roles or default roles, maybe for that matter, to prevent deleting any security groups in Azure.简短的答案是否，没有这样的内置政策。您必须依靠自定义的RBAC角色而不是内置角色。
例如，您要使用
notaction，然后将此操作添加到Microsoft.directory/groups/delete。Short answer is no, there is no such built-in policy. You would have to rely on custom RBAC roles instead of the built-in roles.
For example, you want to use the
NotActionand add this action to itmicrosoft.directory/groups/delete.https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
您可以尝试使用Azure Resources锁定，无论用户权限如何，都可以保护您的资源免受意外删除。检查此链接以获取有关Azure资源锁的更多详细信息：
https://learn.microsoft.com/en-us/azure/azure-resource-manager/manage/management/lock-resources?tabs=json
You can try to use Azure Resources Lock which will protect your resources from accidental deletion, no matter the user permissions. Check this link for more details about Azure resource locks:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json