How to Restrict Azure Cloud Shell Access to a Specific Azure Entra ID Group

Question

I’m looking for guidance on how to restrict access to Azure Cloud Shell for all users in my organization by default. I want to allow access only to members of a specific Azure Entra ID group.

The goal is to enhance security by ensuring that only authorized personnel can use the Cloud Shell environment. Has anyone implemented a similar setup or knows the steps to achieve this?

Any advice or best practices would be greatly appreciated!

Answer 1

Hi @Rajush Rajan

Thank you for posting your query on Microsoft Q&A.

I understand that you are trying to restrict Azure Cloud Shell Access to a Specific Azure Entra ID Group.

But this approach is done via network settings this is not exact solution.

We have another approach using conditional access policy in target resources you can select Windows Azure Service Management API application and include users on your requirement and in grant access select block.

But the problem is other resources also included in Windows Azure Service Management API application like

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#windows-azure-service-management-api

If you think it doesn't impact, you can follow conditional access policy method.

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes.

Thanks,

B. Siri Chandana.