{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "slug": "dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes", "url": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/" }, "title": "Delegate firewall rule-group editing without granting policy-hierarchy changes", "summary": "Match application-team permissions to the documented Firewall Policy delegation pattern.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:01+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 222, "potentially_affected": "Use this review for a proposed application-team delegation model. Identify the team policy, inherited base policy, rule groups and existing effective permissions. The example's restrictions should be verified against the actual role assignments rather than assumed from a custom role's name.", "dse_recommendation": "DSE recommends an explicit allowed-and-denied task list before granting access.", "primary_source": { "name": "Use Azure Firewall policy to define a rule hierarchy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall-manager/rule-hierarchy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Firewall Policy hierarchy example uses a custom role to give application teams selective access to rule collection groups. In the documented outcome, those users cannot delete the firewall or policy, change policy hierarchy, or update DNS and threat-intelligence settings. The example assigns the role at the relevant application-team policy. Microsoft Learn.

\n

Applicability

\n

Use this review for a proposed application-team delegation model. Identify the team policy, inherited base policy, rule groups and existing effective permissions. The example’s restrictions should be verified against the actual role assignments rather than assumed from a custom role’s name.

\n

DSE recommendation

\n

DSE recommends an explicit allowed-and-denied task list before granting access. Have security owners identify the rule groups the team may edit and the policy controls they must retain centrally. Review the current source’s role definition and assignment scope, then check for other grants that could undermine the intended separation. Preserve ownership and access-review evidence with the delegation.

\n

Verification

\n

With an approved test identity, confirm a permitted rule-group edit in a test policy. Assess restricted operations through effective permissions and safe authorization checks, without deleting a production object as a test. Record the identity, assignment scope and outcomes. Resolve broader inherited access before claiming that the delegation is limited to rule editing.

\n

Official references

\n

Microsoft Learn: Use Azure Firewall policy to define a rule hierarchy.

", "content_text": "Source facts\nMicrosoft’s Firewall Policy hierarchy example uses a custom role to give application teams selective access to rule collection groups. In the documented outcome, those users cannot delete the firewall or policy, change policy hierarchy, or update DNS and threat-intelligence settings. The example assigns the role at the relevant application-team policy. Microsoft Learn.\nApplicability\nUse this review for a proposed application-team delegation model. Identify the team policy, inherited base policy, rule groups and existing effective permissions. The example’s restrictions should be verified against the actual role assignments rather than assumed from a custom role’s name.\nDSE recommendation\nDSE recommends an explicit allowed-and-denied task list before granting access. Have security owners identify the rule groups the team may edit and the policy controls they must retain centrally. Review the current source’s role definition and assignment scope, then check for other grants that could undermine the intended separation. Preserve ownership and access-review evidence with the delegation.\nVerification\nWith an approved test identity, confirm a permitted rule-group edit in a test policy. Assess restricted operations through effective permissions and safe authorization checks, without deleting a production object as a test. Record the identity, assignment scope and outcomes. Resolve broader inherited access before claiming that the delegation is limited to rule editing.\nOfficial references\nMicrosoft Learn: Use Azure Firewall policy to define a rule hierarchy.", "content_markdown": "## Source facts\n\nMicrosoft’s Firewall Policy hierarchy example uses a custom role to give application teams selective access to rule collection groups. In the documented outcome, those users cannot delete the firewall or policy, change policy hierarchy, or update DNS and threat-intelligence settings. The example assigns the role at the relevant application-team policy. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall-manager/rule-hierarchy).\n\n## Applicability\n\nUse this review for a proposed application-team delegation model. Identify the team policy, inherited base policy, rule groups and existing effective permissions. The example’s restrictions should be verified against the actual role assignments rather than assumed from a custom role’s name.\n\n## DSE recommendation\n\nDSE recommends an explicit allowed-and-denied task list before granting access. Have security owners identify the rule groups the team may edit and the policy controls they must retain centrally. Review the current source’s role definition and assignment scope, then check for other grants that could undermine the intended separation. Preserve ownership and access-review evidence with the delegation.\n\n## Verification\n\nWith an approved test identity, confirm a permitted rule-group edit in a test policy. Assess restricted operations through effective permissions and safe authorization checks, without deleting a production object as a test. Record the identity, assignment scope and outcomes. Resolve broader inherited access before claiming that the delegation is limited to rule editing.\n\n## Official references\n\n[Microsoft Learn: Use Azure Firewall policy to define a rule hierarchy](https://learn.microsoft.com/en-us/azure/firewall-manager/rule-hierarchy)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "url": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Delegate firewall rule-group editing without granting policy-hierarchy changes", "item": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "url": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/", "headline": "Delegate firewall rule-group editing without granting policy-hierarchy changes", "description": "Match application-team permissions to the documented Firewall Policy delegation pattern.", "abstract": "Match application-team permissions to the documented Firewall Policy delegation pattern.", "articleBody": "Source facts\nMicrosoft’s Firewall Policy hierarchy example uses a custom role to give application teams selective access to rule collection groups. In the documented outcome, those users cannot delete the firewall or policy, change policy hierarchy, or update DNS and threat-intelligence settings. The example assigns the role at the relevant application-team policy. Microsoft Learn.\nApplicability\nUse this review for a proposed application-team delegation model. Identify the team policy, inherited base policy, rule groups and existing effective permissions. The example’s restrictions should be verified against the actual role assignments rather than assumed from a custom role’s name.\nDSE recommendation\nDSE recommends an explicit allowed-and-denied task list before granting access. Have security owners identify the rule groups the team may edit and the policy controls they must retain centrally. Review the current source’s role definition and assignment scope, then check for other grants that could undermine the intended separation. Preserve ownership and access-review evidence with the delegation.\nVerification\nWith an approved test identity, confirm a permitted rule-group edit in a test policy. Assess restricted operations through effective permissions and safe authorization checks, without deleting a production object as a test. Record the identity, assignment scope and outcomes. Resolve broader inherited access before claiming that the delegation is limited to rule editing.\nOfficial references\nMicrosoft Learn: Use Azure Firewall policy to define a rule hierarchy.", "datePublished": "2026-09-17T16:33:01+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-119-delegate-firewall-rule-group-editing-without-granting-policy-hierarchy-changes/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Delegate firewall rule-group editing without granting policy-hierarchy changes" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 222, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use Azure Firewall policy to define a rule hierarchy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall-manager/rule-hierarchy" } } ] } }