Azure RBAC

Bundled into the existing Microsoft Azure Administrator premium course — no separate purchase.

Included in this chapter:

Dimension	Azure RBAC role	Microsoft Entra role
Controls access to	Azure resources (VMs, storage, networks) via Azure Resource Manager	Microsoft Entra ID directory (users, groups, domains, app registrations)
Scope levels	Management group, subscription, resource group, resource	Tenant (organization-wide), administrative unit, or single object
Example roles	Owner, Contributor, Reader, User Access Administrator	Global Administrator, User Administrator, Billing Administrator
Managed in	Access control (IAM) blade; CLI, PowerShell, ARM, REST	Roles and administrators blade; Entra admin center, Graph
Spans the other plane by default	No: an Owner cannot manage directory users	No: a Global Admin has no Azure resource access until elevated

Cheat sheet

A role assignment binds a security principal, a role, and a scope
Scope is a four-level tree and access is inherited downward
Assign at the narrowest scope that does the job
Owner is full management plus the right to assign roles
Contributor manages everything but cannot assign roles
Reader can view resources but change nothing
User Access Administrator manages access, not resources
Effective permissions are additive: they never subtract
Role assignments are transitive through nested groups
Deny assignments are created by Azure, not by you
Azure RBAC roles control resources; Microsoft Entra roles control the directory
By default a Global Administrator has no access to Azure resources
User Administrator and User Access Administrator are different roles on different planes
A Global Admin regains lost subscription access by elevating access
Start with the most restrictive built-in role that fits
Assigning a role requires the roleAssignments/write permission
Classic subscription administrator roles are fully retired
Effective control-plane permission equals Actions minus NotActions
Actions cover management; DataActions cover the data inside resources
Custom roles need a non-root AssignableScopes, no Id, and the right create/update cmdlet
A subscription allows up to 4,000 role assignments, so assign to groups
User-assigned identities are shareable; assigning one needs Managed Identity Operator

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet