Deny Assignment in Read / Access ( DenySettingsMode )

Question

Hello,&nbsp;I would like to confirm with you that it is currently not supported within Azure through any api / cli to set a denyRead type of assignment to a resource ?&nbsp;&nbsp;So are we really only limited to these 3 options : denyDelete, denyWriteAndDelete, Nonehttps://learn.microsoft.com/en-us/javascript/api/@azure/arm-resourcesdeploymentstacks/knowndenysettingsmode?view=azure-node-latest&nbsp;I checked the cli and it correlates.&nbsp;&nbsp;I find the concept of denyAssignment to be tremendously valuable from a security perspective, why is it so limited, and doesn't let us expand to other rights such as read or access ?&nbsp;&nbsp;It would be a much appreciated addition.&nbsp;Thank you !&nbsp;

kidd_ip · Answer

Othmane_ElHanchi&nbsp;
&nbsp;
You may also consider&nbsp;deny-settings-excluded-actions&nbsp;parameter to exclude read actions (such as&nbsp;Microsoft.Resources/*/read

othmane_elhanchi · Answer

As far as i understand, that parameter determines which actions are excluded from the deny assignment.

which is weird considering that the deny assignment itself is so limited, but it would encompass a situation where you deny write assignment but authorize an action like "rename" for instance.

Forum Discussion

Deny Assignment in Read / Access ( DenySettingsMode )

2 Replies