Hierarchical RBAC system for Azure Active Directory - azure-active-directory

Question

I'm looking for a hierarchical RBAC system to be used with Azure Active Directory accounts.
With the hierarchical RBAC system I would like to authorize users to have access and be in roles in a hierarchical structure, e.g.:
Customer 1
role: finance - user G
Shopping mole A
Shop X
role: admin - user U
role: security - user U, user V
role: access - user U, user K, user L
role: finance - user L, user N
Shop Y
role: admin - user Q
...
Customer 2
...
Note that a user could be in a different role for shop X and shop Y.
Any pointers to such a system/library?

Answer 1

• The way you want to use the hierarchical RBAC permissions for the Azure Active Directory accounts in your scenario can be achieved by leveraging the managed identity feature of Identity and Access Management. Through the system assigned managed identity, you can create an identity for the Azure resource that you want to deploy and manage with the user that is assigned to it.
Similarly, if you create a user assigned managed identity for a user, then that user can be assigned varied levels of permissions and privileges relative to the Azure resources that you want to deploy and use such that the same identity can have different permissions and roles for a resource deployed for a particular management group while that same identity assigned to that user can have different permissions and roles for another Aure resource.
• Thus, with regards to Azure AD, there is no such hierarchical system designed as in on-premises Active Directory but the RBAC system in Azure AD is quite robust and useful if used on an optimum basis. As when you said that you want the same user to perform roles in different business units, you can use the user assigned managed identity to a good affect as it will leverage the different RBAC permissions for the same user based on a created and managed identity by Azure that is linked to it thus thereby successfully keeping the user’s original identity discreet and ensuring the RBAC permissions are applied.
For more information, you can surely refer to the documentation link below: -
https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview