Elevated access for viewing Security Advisories

  • Article

This article details how users are required to obtain elevated access roles in order to view Security Advisory details on Azure Service Health.

What are Security Advisories?

Azure customers use Service Health to stay informed about security events that are impacting their critical and noncritical business applications. Security event notifications are displayed on Azure Service Health within the Security Advisories blade. Important security advisory details are displayed in four tabs: Summary, Impacted Services, Issue Updates, and Impacted Resources.

Screenshot of Service Health Security Advisories Blade.

Who can view Security Advisories?

  • Security Advisories are displayed to users at the subscription or tenant level.
  • Users with tenant roles listed here can also access tenant level security advisory details on the Summary and Issue Updates tabs.
  • Only users with elevated access roles can access the information on the summary and issue update tabs. For more information on subscription and tenant roles, see Resource impact from Azure security incidents.

What are Impacted Resources within Security Advisories?

Since details displayed in this tab are sensitive, role based access (RBAC) is required for customers viewing security impacted resources via UI or API. Review this article for more information on the current RBAC requirements for accessing security impacted resources.

Accessing Security Advisories

Accessing Security Advisories requires elevated access across the Summary, Impacted Services, Issue Updates, and Impacted Resources tabs. Users who have subscription reader access, or tenant roles at tenant scope can't view security advisory details until they get the required roles.

1. On the Service Health portal

Only users with elevated access roles can access the information on the Summary, Impacted Resources, and Issue Updates tab.

2. Service Health API Changes

Events API users need to update their code to use the new ARM endpoint (/fetchEventDetails) to receive Security Advisories notification details. If users have the above-mentioned roles, they can view event details for a specific event with the new endpoint. The existing endpoint (/events) that returns all Service Health event types impacting a subscription or tenant, don't return sensitive security notification details.

The endpoints listed here return the security notification details for a specific event.

New API Endpoint Details

  • To access the new endpoint, users need to be authorized with the above-mentioned roles.
  • This endpoint returns the event object with all available properties for a specific event.

Example

https://management.chinacloudapi.cn/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/providers/microsoft.ResourceHealth/events/{trackingId}/fetchEventDetails?api-version=2023-10-01-preview

Operation: POST

Impacted Resources for Security Advisories

  • Customers authorized with the above-mentioned roles can use the following endpoints to access the list of resources impacted by a Security Incident

Subscription

https://management.chinacloudapi.cn/subscriptions/bbbb1b1b-cc2c-dd3d-ee4e-ffffff5f5f5f/providers/microsoft.resourcehealth/events/{trackingId}/listSecurityAdvisoryImpactedResources?api-version=2023-10-01-preview

Operation: POST

Tenant

https://management.chinacloudapi.cn/providers/microsoft.resourcehealth/events/{trackingId}/listSecurityAdvisoryImpactedResources?api-version=2023-10-01-preview

Operation: POST

Existing Events API Endpoint

Security Advisories Subscription List Events

The existing Events API endpoint which returns the list of events (including security events with event Type: “Security”) will be restricted to pass only nonsensitive properties listed below for security events. 
https://management.chinacloudapi.cn/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/providers/microsoft.ResourceHealth/events?api-version=2023-10-01-preview&$filter= "eventType eq SecurityAdvisory"

Operation: GET

The following values in the events object response are populated for security Advisories events using this endpoint:

  • ID
  • name
  • type
  • nextLink
  • properties

Only the following are populated in the properties object:

  • eventType
  • eventSource
  • status
  • title
  • platformInitiated
  • level
  • eventLevel
  • isHIR
  • priority
  • subscriptionId
  • lastUpdateTime
  • impact

The impactedService property is populated for the impact object, but only the following properties in the impactedServiceRegion object in the impact object are populated:

  • impactedService
  • impactedSubscriptions
  • impactedTenants
  • impactedRegion
  • status

Next steps