ABAC (Attribute Based Access Control) is an access control model where access is determined based on attributes related to the user, resource, action, and context.

How does ABAC differ from RBAC?

RBAC grants access based on roles, while ABAC evaluates multiple factors simultaneously, enabling more dynamic and context-aware access control.

What attributes are used in ABAC?

Typically attributes related to the user, resource, action, and environment, such as location, time, and device.

Where is ABAC used in practice?

ABAC is used in modern identity and access management, especially in cloud environments and Zero Trust architectures.

How is ABAC implemented in Microsoft environments?

Through mechanisms such as Azure ABAC and Conditional Access in Entra ID, enabling context-based access control.

ABAC (Attribute Based Access Control)

What is ABAC?

ABAC (Attribute Based Access Control) is an access control model where access to systems and data is determined based on attributes from four categories: the subject (user), the resource, the action, and the environment. The model is defined in NIST SP 800 162.

Instead of relying only on roles, as in RBAC, ABAC evaluates multiple factors at the same time. These can include who the user is, which device is being used, where the request is coming from, and what resource is being accessed. In practice, RBAC and ABAC are usually combined as a hybrid, where roles grant coarse access and attributes refine it.

This allows for more precise and dynamic access control, where decisions are made based on context.

A simple way to understand ABAC is to think of an access system that checks not just identity, but also time, location, device state, and which resource is being requested.

Sicra and ABAC

ABAC is relevant in modern identity and access management, especially in Zero Trust architectures. In the Microsoft stack, the model is realized concretely through conditions on role assignments in Azure (Azure ABAC) and, relatedly, through Conditional Access in Entra ID.

At Sicra, it is used when assessing how organizations can improve control over access and reduce risk related to excessive or misconfigured permissions.

This is particularly relevant in environments with cloud, distributed users, and complex access requirements.

Services

Need Assistance?

We are happy to have a non-binding conversation.