job-function-scoped-roles

Type: regulative

Decision

A role must be scoped to a job function and assigned to the application's Entra ID group, never to an individual or a resource type.

Why

Without job-function scoping, every new allowed resource type forces team re-onboarding.

Violations

• Custom role with wildcard write permissions.
• Role scoped to a resource type rather than a job function.

Anchor

no-platform-ops

Implements

• platform-member

Files

• platform-management/access-control/parameters/accessControl.bicepparam
• platform-management/access-control/bicep/modules/customRoleDefinitions.bicep

← Back to knowledge graph