My Azure Portal Extension

This extension works to enhance user experience of Microsoft Azure Portal.

Supported browsers

• Chrome
• Edge

How to install

• Chrome: Install from the Chrome Web Store.
• Edge: Install from Microsoft Edge Add-ons.

Features

No.1: Blur displayed UUID-formatted subscription IDs throughout Azure Portal.

No.2: Configure Azure Portal background image with image url and image opacity.

No.3: Blur username, Entra tenant throughout Azure Portal.

No.4: Show direct user RBAC list for subscription and resource groups. This feature is require to use App registration.

No.5: Entra ID sign-in with automatic token refresh for ARM API calls.

No.6: Highlight empty resource group. This feature is require to use No.5 Entra ID sign-in and App registration.

No.7: Show direct user RBAC assignments in a Subscription and Resource Group hierarchy. This feature is require to use No.5 Entra ID sign-in and App registration.

Direct user RBAC panel

The panel is disabled by default. It can be enabled or disabled from Extension Settings > RBAC Visibility on authenticated Azure Portal pages. The colored header can be dragged, and the details can be collapsed or expanded.

The panel displays:

• Tenant ID
• Subscription name
• Direct user role assignments at Subscription scope
• Direct user role assignments at Resource Group scope
• Role names such as Owner, Contributor, and Reader
• User principal names or email addresses when Microsoft Graph resolution is available

The panel intentionally excludes:

• Roles inherited from a parent scope
• Group assignments
• Service principals
• Managed identities
• Azure Lighthouse assignments
• Resource-level assignments

Only assignments whose properties.scope exactly matches the current Subscription or Resource Group scope are displayed. While data is being retrieved, the panel shows a loading message. If no matching assignments are found, it shows an explicit empty result message.

If user names cannot be resolved, the panel falls back to principal IDs and displays this guidance:

Add User.ReadBasic.All as a Microsoft Graph delegated API permission to the App registration, grant admin consent, and sign in again.

How to configure them

Click extension icon on your browser first, then setting popup of this Extension will be shown.

Configure this exntesion with the view as follows.

For ARM API authentication in v0.4.0, this is now a sign-in flow:

1. Enter Tenant ID and Client ID.
2. Click save.
3. Click Sign in.

No manual access-token copy/paste is required.

Authentication for ARM API (Entra ID)

This extension now works as an independent OAuth client. It does not rely on the Azure portal session token.

Quick start (v0.4.0)

1. Register an Entra ID App as SPA (one-time setup).
2. Set Tenant ID and Client ID in the popup.
3. Click Sign in.

The extension stores tokens in chrome.storage.local and refreshes them automatically before expiration.

Important prerequisites

• You must create and register a Service Principal (App registration) in Entra ID before using ARM authentication in this extension.
  • MS Learn: https://learn.microsoft.com/entra/identity-platform/quickstart-register-app
• In the extension popup, copy the value shown in Redirect URI (register this exact value) and register that exact value in the Service Principal Redirect URI.
  • MS Learn: https://learn.microsoft.com/entra/identity-platform/how-to-add-redirect-uri
• Register the Service Principal as Single-page application (SPA).
  • MS Learn: https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow#redirect-uris-for-single-page-apps-spas

1. Register an Entra ID app

Create a new App registration in Entra ID and configure it as SPA.

• Platform: Single-page application (SPA)
• Redirect URI: value returned by chrome.identity.getRedirectURL()
  • Example: https://<your-extension-id>.chromiumapp.org/
• Delegated API permission: Azure Service Management user_impersonation
• Delegated API permission: Microsoft Graph User.ReadBasic.All (required for user name resolution)
• Recommended scopes in sign-in flow: openid profile offline_access

RBAC tree prerequisites

The Direct user RBAC panel requires the following configuration:

• Keep the delegated Azure Service Management user_impersonation permission.
• Add the delegated Microsoft Graph User.ReadBasic.All permission to the App registration and grant admin consent.
• The signed-in user must have Microsoft.Authorization/roleAssignments/read on the target subscriptions. The built-in Reader role normally provides the required read access.
• The extension uses delegated authentication. The App registration's service principal does not need an additional Owner or Contributor role assignment for this feature.
• After changing API permissions, reload the extension and sign in again.

2. Configure this extension

Open the extension popup and set:

• Tenant ID
• Client ID (from App registration)

Click save, then click Sign in once.

3. Token lifecycle

• Access and refresh tokens are saved in chrome.storage.local.
• The service worker refreshes token silently before expiration using chrome.alarms.
• If silent refresh cannot continue (e.g. revoked consent), sign in again from the popup.

Legacy flow (deprecated)

Older versions used manual token acquisition (for example, running az account get-access-token and pasting a short-lived token into the extension).

This workflow is deprecated in v0.4.0 and is no longer recommended.

4. Required permissions (manifest)

The extension uses the following permissions and hosts:

• identity, storage, alarms
• https://login.microsoftonline.com/*
• https://management.azure.com/*
• https://graph.microsoft.com/*

If ARM calls fail, check extension logs from the extension service worker in browser developer tools.

Release notes

See CHANGELOG.md for the v0.1.0 to v0.4.0 summary.

Version-specific release notes are maintained in the Release folder.

Release packaging

1. Copy secrets.local.example.json to secrets.local.json.
2. Put the production Application Insights connection string into secrets.local.json.
3. Run npm ci.
4. Run npm run build to compile the TypeScript sources.
5. Run bash scripts/package.sh to generate dist/my-azure-portal-extension-v<version>.zip.

The TypeScript sources are under src/. The extension root contains compiled output used by Chrome. The extension no longer depends on jQuery at runtime.

GitHub Actions now runs the same packaging flow in CI and release jobs. The release workflow expects a repository secret named APPINSIGHTS_CONNECTION_STRING.

Reference for development

• https://developer.chrome.com/extensions/webRequest
• https://github.com/otiai10/kanColleWidget/wiki/%E5%A4%96%E9%83%A8Chrome%E6%8B%A1%E5%BC%B5%E9%80%A3%E6%90%BA%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6
• http://qiita.com/mdstoy/items/9866544e37987337dc79
• http://stackoverflow.com/questions/15502691/chrome-webrequest-not-working
• https://docs.microsoft.com/en-us/rest/api/
• http://easyramble.com/chrome-storage-set-and-get.html
• https://qiita.com/nulltypo/items/4e5c494971955c767531

Copyright

Copyright	Copyright (c) 2017 - Daichi Isami
License	MIT License