Allow users to restrict an az login session to one resource group or resource

Aperta
  • Qualcosa non va?
#34,162 4 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@isra-fel ci sta già lavorando.

Dal 3/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Account act-codegen-extensibility-squad act-identity-squad ARM Auto-Assign Azure CLI Team customer-reported feature-request

Related command

az login

Suggested syntax below is illustrative, not an existing option.

Is your feature request related to a problem? Please describe.

My Azure user has legitimate access to several resource groups, including production systems. When working on development, I would like that specific login session to only have access to the development group.

This would be useful for ordinary terminal work, scripts, automation and agents. My account needing production access does not mean every work session I have needs it.

Read-only mode does not solve this. I need to write within the selected group, AND prevent reads of sensitive resources outside it.

Describe the solution you'd like

Could az login let a user voluntarily narrow their existing permissions for one session, without administrator collaboration or changes to their normal role assignments?

For example:

az login --restrict-to \
  "/subscriptions/<subscription-id>/resourceGroups/development"

Then ordinary commands would behave like this:

# Allowed if my user already has the required permissions.
az storage blob upload \
  --account-name devstorage \
  --container-name test \
  --name example.txt \
  --file ./example.txt \
  --auth-mode login

# Blocked because production is outside this session's scope.
az group show --name production

# Also blocked.
az group delete --name production

Resource-group scoping would already take us pretty far. Ideally, the same approach could allow selecting an individual resource within a group.

The restriction should be tied to the session's credentials and enforced by Azure. Changing command arguments, configuration or using the token directly should not bypass it. It should only reduce existing access, never grant additional permissions.

Describe alternatives you've considered

  • A separate identity with scoped RBAC. That can work, but requires provisioning another identity and permission assignments rather than simply narrowing my current login.
  • Storage SAS tokens. Useful for specific storage tasks, but not a general solution for Azure resource management.
  • Default resource groups, shell wrappers and instructions to agents. These help avoid mistakes, but do not restrict what the credentials can access.

Additional context

This is a general CLI safety feature, not specifically an agent identity or MCP request. Agents are one use case where limiting the consequences of mistakes matters.

The restricted workflow should not silently fall back to unrestricted credentials. Other broad credentials accessible on the machine would still need to be kept away from the script or agent.

I am not sure whether Azure's existing authorization APIs support this. Could someone familiar with CLI authentication clarify whether it is feasible today, or which underlying Azure capability would be needed?

Related: #32974, global read-only mode. This request differs because it allows writes within the selected scope while also blocking sensitive reads outside it.

Lingua principale
Python
Stelle
4.7k
Fork
3.5k
Merge medio
4g 14h
PR unite (30g)
92

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Azure/azure-cli

Tutte le issue di Azure/azure-cli

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.