Azure RBAC
Role-based access control for resource operations, expressed as a role assignment at a scope and evaluated additively.
Readiness
0%
2h 40m baseline
Exam memorization points
- A role assignment is the combination of a security principal, a role definition, and a scope.
- Scope order from widest to narrowest: management group > subscription > resource group > resource.
- Key built-in roles: Owner (everything plus access management), Contributor (everything except access management and deny assignments), Reader, User Access Administrator (access management only), and the Storage Blob Data * data-plane roles.
- RBAC is additive: effective permissions are the union of all role assignments at the principal's scopes.
- Deny assignments (created by Azure Blueprints or deployment stacks) override every allow assignment, including Owner.
- Custom roles are JSON role definitions with Actions, NotActions, DataActions and NotDataActions, plus assignable scopes.
Traps & distractors
- Assuming Contributor can grant access. Only Owner and User Access Administrator can create role assignments.
- Confusing Entra ID directory roles with Azure RBAC roles. A Global Administrator has no resource access until they elevate or are assigned an RBAC role.
- NotActions are not a deny. They subtract from the allowed set; another assignment at a different scope can still grant the operation.
- Resource locks are not RBAC. CanNotDelete and ReadOnly are evaluated separately and apply to everyone.
- Forgetting that data-plane access to storage needs a data role (for example Storage Blob Data Reader) even when the account is owned by the caller.
Suggested lab
Least-privilege role assignments and effective access
Prove inheritance, additive behaviour and the Contributor access-management gap.
- 1Assign Reader to a test user at the resource group scope.
- 2Assign Virtual Machine Contributor to the same user at a single VM scope.
- 3Sign in as the user and confirm VM operations succeed while creating a role assignment fails.
- 4Grant the user Storage Blob Data Reader on a storage account and read a blob, then try the same without the data role.
- 5Create a custom role that allows only the Microsoft.Compute/virtualMachines/start/action and assign it at subscription scope.
Microsoft Learn
- What is Azure role-based access control (Azure RBAC)?doc
- Search Microsoft Learn: Azure RBAC built-in roles custom role definition scopesearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight100% × 25% = 25.0
This topic's domain carries 22.5% of the exam objectives.
- Dependency leverage32% × 20% = 6.5
2 later topics depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Baseline study time
2h 40m
Complexity
3 / 5
Remaining to target
2h 16m
Status weight
0%
Topics: role assignment, scope, owner, contributor, custom role, deny assignment, iam
Weak neighbours in Identities