Elevated access for viewing Security Advisories

  • Article

This article details how users are required to obtain elevated access roles in order to view Security Advisory details on Azure Service Health.

What are Security Advisories?

Azure customers use Service Health to stay informed about security events that are impacting their critical and noncritical business applications. Security event notifications are displayed on Azure Service Health within the Security Advisories blade.

Important security advisory details are displayed in four tabs: Summary, Impacted Services, Issue Updates, and Impacted Resources.

Screenshot of Service Health Security Advisories Blade.

Who can view Security Advisories?

  • Security Advisories are displayed to users at the subscription or tenant level.
  • Only users with elevated access roles can access the information on the summary and issue update tabs for sensitive security events. For more information on elevated access subscription and tenant roles, see Resource impact from Azure security incidents.
  • Users with tenant roles listed here can also access tenant level security advisory details on the Summary and Issue Updates tabs.

What are Impacted Resources within Security Advisories?

Since details displayed in this tab are sensitive, role based access (RBAC) is required for customers viewing security impacted resources via UI or API. Review this article for more information on the current RBAC requirements for accessing security impacted resources.

Accessing Security Advisories

Accessing sensitive data for Security Advisories requires elevated access across the Summary, Impacted Services, Issue Updates, and Impacted Resources tabs. Users who have subscription reader access, or tenant roles at tenant scope can't view sensitive security advisory details until they get the required roles.

1. On the Service Health portal

Only users with elevated access roles can access sensitive information on the Summary, Impacted Resources, and Issue Updates tab.

2. Service Health API Changes

API users need to update their code to use the new ARM endpoint (/fetchEventDetails) to receive sensitive Security Advisories notification details. Users with the specified roles can view sensitive event details for a specific event with the new endpoint. The existing endpoint (/events) which returns all Service Health event types impacting a subscription or tenant, doesn't return sensitive security notification details.

The endpoints listed here return the security notification details for a specific event.

New API Endpoint Details

  • To access the new endpoint, users need to be authorized with the above-mentioned roles.
  • This endpoint returns the event object with all available properties for a specific event.

Example

https://management.chinacloudapi.cn/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/providers/microsoft.ResourceHealth/events/{trackingId}/fetchEventDetails?api-version=2023-10-01-preview

Operation: POST

Impacted Resources for Security Advisories

  • Customers authorized with the above-mentioned roles can use the following endpoints to access the list of resources impacted by a Security Incident.

Subscription

https://management.chinacloudapi.cn/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/providers/microsoft.resourcehealth/events/{trackingId}/listSecurityAdvisoryImpactedResources?api-version=2023-10-01-preview

Operation: POST

Tenant

https://management.chinacloudapi.cn/providers/microsoft.resourcehealth/events/{trackingId}/listSecurityAdvisoryImpactedResources?api-version=2023-10-01-preview

Operation: POST

Existing Events API Endpoint

Security Advisories Subscription List Events

The existing Events API endpoint which returns the list of events (including sensitive security events with property 'eventType' : `Security` and property 'isEventSensitive' = true) will be restricted to not pass sensitive properties listed below for security events. 
https://management.chinacloudapi.cn/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/providers/microsoft.ResourceHealth/events?api-version=2023-10-01-preview&$filter= "eventType eq SecurityAdvisory"

Operation: GET

The following properties in the events object response aren't populated for sensitive Security Advisories events using this endpoint:

  • Summary
  • Description
  • Updates

Next steps