A ferry-terminal security desk re-creates the same Reader assignmen…

Question

A ferry-terminal security desk re-creates the same Reader assignment for twelve individual users whenever a seasonal worker starts. What should the desk do instead so membership changes do not require new role assignments?

Accepted Answer

Assign Reader once to a Microsoft Entra security group at the resource-group scope and manage membership in the group — Stop laminating twelve badges every hiring day. Put Reader on one Entra security group at the resource group, then toss seasonal workers into or out of that group—membership changes, the role assignment stays put.

Answer

Assign Reader to each user at subscription scope so one assignment covers all future seasons

Answer

Store each user’s object ID in an Azure Policy initiative and grant Reader through policy

Answer

Replace Azure RBAC with a shared Reader service principal password rotated each season

A ferry-terminal security desk re-creates the same Reader assignment for twelve individual users whenever a seasonal worker starts. What should the desk do instead so membership changes do not require new role assignments?

Short Explanation

Full Explanation