Role-Based Access Control (RBAC)

RBAC is how Azure decides what you can do after you sign in. It lets you assign roles to users, groups, or apps at different levels (subscription, resource group, resource). This prevents giving everyone full admin rights and ensures the principle of least privilege.

Key RBAC Concepts

• Role: A set of permissions (what actions can/cannot be performed).
• Scope: Where the role applies (Subscription → Resource Group → Resource).
• Assignment: Binding a user/group/service principal to a role at a given scope.

Built-in RBAC Roles

• Owner: Full control, including delegating access.
• Contributor: Can create/manage resources, but cannot grant access.
• Reader: Read-only access.
• User Access Administrator: Can manage RBAC assignments, but not the resources themselves.

Custom Roles

You can create custom roles by defining JSON templates that specify allowed actions and denied actions.

Confusion Buster 🚨

RBAC Roles ≠ Entra Roles
– Entra Roles (like Global Administrator) → Tenant-wide, identity directory management.
– RBAC Roles (like Contributor, Reader) → Resource-level, Azure environment management.
Exam trick: If the question is about managing resources → RBAC. If it’s about managing users, groups, and licenses → Entra Roles.

Simple Example

You want John to create VMs but not delete other resources. Assign him the Contributor role at the Resource Group scope. He can deploy resources but cannot change RBAC assignments or elevate his own permissions.

Exam Tip

Always think scope first. If you assign a role at subscription level, it applies everywhere below. If you assign it only at the VM level, it applies just to that VM.

What to Expect in the Exam

• Direct Q: “Which RBAC role can assign permissions to others?” → Owner or User Access Administrator.
• Scenario: “A user can read and create resources but cannot manage access.” → Contributor.
• Trick Q: “Global Administrator can manage all VMs in a subscription.” (False, that’s an Entra role, not RBAC).