Think of a filing cabinet: the cabinet is your company, drawers are subscriptions (each with its own bill), folders are resource groups, papers are the resources. A key to a drawer opens every folder in it.
Nothing flows upward or sideways. A role or policy set on MG-Corp lands on Prod, Dev and everything inside them. A role set on RG-Web touches nothing in RG-Data.
Giving people access: the problem RBAC solves
Contoso has 50 employees and 20 virtual machines spread across the Prod and Dev subscriptions. Not everyone should have full access. Sarah in finance only needs to see what exists so she can check the bill. Ravi in operations must manage the web servers. Priya runs the helpdesk and must be able to give colleagues access when they join. If everyone were simply made an administrator, one mistaken click could delete production.
Azure's answer is role-based access control (RBAC): instead of making people administrators, you give each person a role (a named list of allowed actions) at a scope (one place in the tree). From that place downward, they can do what the role allows and nothing else.
A role assignment has three parts
| Part | Plain meaning | Sarah's case |
|---|---|---|
| Who (the security principal (the thing being given access: a user, a group, or an application identity)) | The person or team. Prefer a group so access survives staff changes. | Sarah, or better the group Finance-Readers |
| Which role (the role definition (a named list of actions Azure allows, such as read, write, delete)) | Azure ships about 100 ready-made roles; four general ones cover most questions. | Reader |
| Where (the scope (the point in the tree where the role applies; it flows down from there)) | Management group, subscription, resource group, or a single resource. | The Prod subscription |
Result: Sarah can open any resource in Prod and look at it, but every Save or Delete button is refused. She sees nothing in Dev, because Dev is not under Prod.
Quick check
Sarah has Reader on the Prod subscription. Can she view the VMs in RG-Test, which is in the Dev subscription?
The four general roles
Role names do not always say exactly what they permit, so learn these four by what they cannot do.
| Role | Can | Cannot | Give it to |
|---|---|---|---|
| Reader | Look at anything in scope | Change anything | Sarah (finance) |
| Contributor | Create, change, delete anything in scope | Give access to others; create locks | Ravi (operations) |
| User Access Administrator | Give and remove roles; manage locks | Touch the resources themselves | Priya (helpdesk) |
| Owner | Everything, including giving access | — | As few people as possible |
Narrower roles exist for one resource type: Virtual Machine Contributor (manage VMs but not the network or storage they use), Network Contributor, Storage Account Contributor. The exam asks you to pick the narrowest role that still meets the requirement; this is called least privilege.
Quick check
Priya must be able to give new helpdesk staff access to VMs in RG-Prod, and must not be able to change or delete anything. Which role?
Rule 1: permissions flow downward
A role given at the subscription applies to every resource group and resource inside it. A role given on RG-Web applies only to what is in RG-Web. So choose the scope from the wording: "all VMs in the Prod subscription" means subscription scope; "the VMs in RG-Web only" means resource-group scope; "this one VM" means resource scope. Assign at the highest level that is still correct and do not repeat the same role on every resource below.
Rule 2: several roles add together
Ravi has Reader on the Prod subscription (so he can see everything) and Virtual Machine Contributor on RG-Web. Inside RG-Web he has both: he can see everything and manage the VMs. The narrower assignment adds power; it never removes what was inherited. There is no ordinary way to write "except Ravi" into RBAC. (Azure does have deny assignments, but you do not create them by hand; they are made for you by features such as deployment stacks, Blueprints and managed applications, and the exam only expects you to know they exist and win over grants.)
Quick check
Ravi has Reader on subscription Prod and Contributor on RG-Web. What can he do to a VM in RG-Web?
Rule 3: Entra ID roles are not Azure roles
Entra ID has its own roles for running the directory: Global Administrator, User Administrator and so on. They control users, groups and licences. They give no rights on subscriptions or resources. A new Global Administrator opens the portal and sees no subscriptions at all. Two fixes: someone with Owner gives them an Azure role, or they use elevate access (a one-time switch in Entra ID properties, "Access management for Azure resources", that grants the Global Admin the User Access Administrator role at the root of every subscription) and then assign themselves what they need. Elevated access should be removed afterwards.
Quick check
A Global Administrator signs in to the portal and sees no subscriptions. What is the most likely reason?
Rule 4: managing a storage account is not the same as reading the files in it
Changing a resource's settings is the management plane (the portal and API operations that create and configure resources). Reading or writing what is stored inside it is the data plane (operations on the contents: blobs, files, queue messages, secrets). Contributor and Owner cover the management plane. To read blobs through Entra sign-in, a person also needs a data role such as Storage Blob Data Reader. A Contributor can usually still reach the data by fetching the storage account key, unless key access has been disabled, which is why exam answers prefer Entra data roles over keys.
Memorise (definitions)
- The three parts: who, which role, where
- The four general roles and what each cannot do
- Scopes from widest to narrowest: management group, subscription, resource group, resource
- Entra roles ≠ Azure roles; elevate access exists
- Data roles (Storage Blob Data Reader/Contributor) are separate
Apply (scenarios you must solve)
- Pick the narrowest role and widest-correct scope for a requirement
- Combine two assignments and say what the person can do
- Spot that a Contributor cannot grant access or add a lock
- Explain why a Global Administrator sees nothing
- Decide whether a question is about configuring storage or reading its contents
Doing it in the portal
You, the admin: give Finance-Readers read access to everything in Prod
- Make the group Finance-Readers in Entra ID and add Sarah.
- Open Subscriptions › Prod › Access control (IAM) › + Add › Add role assignment.
- Role tab: Reader. Members tab: the group. Review + assign.
- Later, Ravi needs to manage VMs in RG-Web only: a second assignment, Virtual Machine Contributor at RG-Web › Access control (IAM). The two add together.
- Verify: RG-Web › Access control (IAM) › Check access, type the name; it lists every role they hold and where it came from.
Script: az role assignment create --assignee <group id> --role Reader --scope /subscriptions/<id>. Custom roles, when no built-in fits: IAM › + Add › Add custom role, or az role definition create with a JSON of Actions, NotActions, DataActions and AssignableScopes.