Azure RBAC: roles, scope, access assignments, and change auditing

radio_button_uncheckedshort_text1. Secure access without blocking productive work

Protecting virtual machines, websites, networks, storage, and their data requires more than authentication. People, partners, and applications still need enough authority to complete approved work. Azure role-based access control (Azure RBAC) provides the authorization layer that answers three operational questions: who can reach an Azure resource, which operations they can perform, and where that permission applies.

Imagine an engineering consultancy that has moved projects to Azure so several offices and partner companies can collaborate. The IT team must keep shared assets protected while granting each participant only the access required by the project. This chapter turns that scenario into a repeatable access-management workflow.

• Verify your own access and investigate the effective access of another principal.
• Select a suitable role and grant it at the narrowest practical scope.
• Remove access when it is no longer justified.
• Use the Azure Activity Log to review role-assignment and custom-role changes.

radio_button_uncheckedshort_text2. Authentication, identity, and Azure authorization

Microsoft Entra ID establishes identity and supports sign-in, single sign-on, users, groups, service principals, and managed identities. Azure RBAC uses those identities to authorize operations on Azure resources. Authentication proves who or what is calling; authorization decides whether that caller may perform the requested action at the target scope.

Each Azure subscription trusts one Microsoft Entra tenant. Principals from that directory can receive Azure role assignments for the subscription and its descendants. Hybrid organizations can synchronize or provision workforce identities from on-premises Active Directory by using Microsoft Entra Connect or other supported identity provisioning methods. Disabling the source account and revoking its sessions removes the person’s usable cloud identity, but administrators should also remove obsolete role assignments so they do not remain as Identity not found entries.

radio_button_uncheckedshort_text3. Distinguish Azure roles, Microsoft Entra roles, and classic administrators

Azure roles govern Azure resources through Azure Resource Manager. Microsoft Entra roles govern directory resources such as users, groups, enterprise applications, and tenant settings. Classic subscription administrator roles belong to an older authorization model and should not be confused with either modern role system.

A subscription is associated with one Microsoft Entra tenant, contains resource groups, and each resource belongs to one resource group. Roles assigned above a child scope can be inherited by that child. Directory authority does not automatically grant Azure resource authority, and an Azure resource role does not automatically grant directory administration.

radio_button_uncheckedshort_text4. What Azure RBAC enables

Azure RBAC provides fine-grained access management on top of Azure Resource Manager. It lets a platform team separate duties without creating a unique permission list for every person.

• Let one operator manage virtual machines while another manages virtual networks in the same subscription.
• Give a database administrator group control of SQL databases without granting unrelated resource permissions.
• Allow a project team to manage every resource inside one resource group but nothing outside it.
• Grant an application or managed identity access to the resources it needs for automation.
• Provide read-only access for auditors and operational access for support teams.
• Delegate access administration with a privileged role and, where supported, a restrictive role-assignment condition.

radio_button_uncheckedshort_text5. The who, what, and where of a role assignment

Access is granted by creating a role assignment. Every assignment joins a security principal, a role definition, and a scope. Think of these as who receives access, what permissions are granted, and where those permissions are valid. Removing the assignment revokes that grant.

A current role assignment can also include a description, an optional condition, and—when Microsoft Entra PIM capabilities and licensing apply—an eligible, active, permanent, or time-bound assignment type. These controls refine the grant; they do not replace the three core elements.

radio_button_uncheckedshort_text6. Security principals: users, groups, and workload identities

Group role assignments are transitive: a user can receive access through nested group membership when the membership model supports it. For infrastructure as code, use the principal object ID and specify the principal type correctly. Deleted principals do not automatically remove their role assignments, so access reviews should clean up orphaned assignments.

radio_button_uncheckedshort_text7. Role definitions and permission fields

A role definition is a named collection of permissions. Built-in definitions are maintained by Microsoft; custom definitions let an organization package a specific permission set when no built-in role is suitable. A role definition can be reused in many assignments and scopes.

{
  "Name": "Virtual Machine Restart Operator",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/restart/action"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": ["/subscriptions/<subscription-id>"]
}

Effective role permissions begin with Actions minus NotActions and DataActions minus NotDataActions. Because Azure RBAC is additive, another assignment can still grant an operation removed by NotActions. Use deny assignments only in the Azure-managed scenarios that support them; NotActions is a role-shaping mechanism, not a deny rule.

radio_button_uncheckedshort_text8. Fundamental built-in roles and least privilege

The supplied export alternately mentions more than 70 and more than 200 built-in roles. The current Microsoft listing describes more than 120. The exact count changes as services add and retire roles, so the exam skill is selecting the narrowest suitable built-in role rather than memorizing a number.

For the exercise scenario, Virtual Machine Contributor is preferable to Contributor because it targets virtual machine management and does not permit role assignment. It also does not automatically grant management of the virtual network or storage account attached to the VM. Always inspect the current definition before assignment.

radio_button_uncheckedshort_text9. Scope hierarchy, inheritance, and blast radius

Azure RBAC supports four scope levels from broad to narrow: management group, subscription, resource group, and resource. A grant at a parent is inherited by eligible children. A role at subscription scope therefore reaches its resource groups and resources; a role at one resource affects only that resource.

Least privilege applies to permissions and scope. If an administrator needs one VM, assign the appropriate role on that VM—not on the resource group. If a developer needs full management of one resource group, assign the suitable role at the resource-group scope—not at subscription scope.

radio_button_uncheckedshort_text10. How effective access is evaluated

Azure RBAC is primarily an additive allow model. If one assignment grants read and another grants write over the same target, the principal receives both. Multiple group memberships and inherited assignments can contribute permissions. A narrower Reader assignment does not reduce Contributor access inherited from a parent.

1. The caller obtains a token that represents its identity and group memberships.
2. Azure Resource Manager finds applicable role assignments and deny assignments for the target.
3. An applicable deny assignment blocks the action; otherwise evaluation continues.
4. Applicable roles are combined, including inherited and group-based grants.
5. Actions minus NotActions and DataActions minus NotDataActions produce the role permissions.
6. Any role-assignment condition is evaluated for the requested action and context.
7. The operation is allowed only when an applicable grant remains and all required conditions pass.

radio_button_uncheckedshort_text11. Access control (IAM) in the Microsoft Azure portal

Access control (IAM) appears at management-group, subscription, resource-group, and resource scopes in the Microsoft Azure portal. It is the main workspace for checking access, reviewing role assignments, viewing role definitions, granting access, and removing access.

• Check access: inspect your own or another principal’s effective assignments at and inherited to the selected scope.
• Role assignments: list who has which role, the scope source, assignment type, condition, and other details.
• Roles: list built-in and custom definitions and open their permissions and assignments.
• Deny assignments: inspect system-protected restrictions when present.
• Classic administrators: review legacy subscription administrators where the tab still applies.

Portal labels evolve. The exported exercise uses Profile > My permissions. Current documentation emphasizes opening the target resource, selecting Access control (IAM), opening Check access, and choosing View my access. Both approaches express the same study objective: list the roles and scopes that currently apply to you.

radio_button_uncheckedshort_text12. Exercise: verify your own access

You need an Azure subscription and permission to view the selected scope. A free Azure account or an Azure for Students subscription can be used when eligible; available offers and terms can change.

1. Sign in to the Microsoft Azure portal and open the management group, subscription, resource group, or resource you want to inspect.
2. Select Access control (IAM), then open Check access.
3. Select View my access. If Microsoft Entra PIM is integrated, inspect active, eligible, and time-bound assignments on the appropriate tab.
4. Record the role name, assignment scope, whether it is inherited, any condition, and whether activation is required.
5. If using the profile-level My permissions entry available in your portal experience, compare its subscription-oriented result with the selected resource’s IAM view.

radio_button_uncheckedshort_text13. Exercise: list access for a resource group

1. Search for Resource groups in the portal and open the target group, such as a training group named example-group.
2. Select Access control (IAM) and open Role assignments.
3. Compare assignments whose scope is This resource with entries inherited from the subscription or management group.
4. Use filters for role, principal type, scope, or assignment type to isolate the result you need.
5. Open Check access when investigating one user, group, service principal, or managed identity.

An assignment created on the resource group applies to resources inside it. An inherited assignment was created above the group and must be changed or removed at its original scope. Do not try to delete an inherited assignment from the child view.

radio_button_uncheckedshort_text14. Exercise: inspect roles and their assignments

1. From Access control (IAM), open the Roles tab to list built-in and custom role definitions available at the selected scope.
2. Filter by name, description, type, or category. Open View in the Details column for a role.
3. Review Permissions to understand Actions, NotActions, DataActions, and NotDataActions.
4. Open Assignments to see how many users, groups, and workload identities receive that role and at which scopes.

Role names alone are not enough for a security decision. Service roles can include surprising control-plane or data-plane operations, and built-in definitions can evolve. Review the current permission list and assignment scope before approval.

radio_button_uncheckedshort_text15. Exercise: grant Virtual Machine Contributor access

The scenario requires a colleague to create and manage virtual machines for one project. The least-privilege design is Virtual Machine Contributor on the project resource group, assuming every VM in that group is in scope. To create the assignment, the administrator needs Microsoft.Authorization/roleAssignments/write, available through roles such as Role Based Access Control Administrator or User Access Administrator.

1. Open the target resource group and select Access control (IAM) > Role assignments.
2. Select Add > Add role assignment. A disabled command indicates that the current caller lacks assignment permission.
3. On Role, search for Virtual Machine Contributor, inspect its details, select it, and continue.
4. On Members, choose User, group, or service principal; select members; search for the colleague; and add the selection.
5. Add a concise description explaining the project and approval. If a Conditions or Assignment type tab appears, configure only what the access design and licensing require.
6. On Review + assign, verify principal, role, scope, condition, type, and duration, then confirm the assignment.
7. Return to Role assignments or Check access and verify that the new grant appears at the intended scope.

radio_button_uncheckedshort_text16. Remove access and clean up assignments

Access is revoked by removing the role assignment that grants it. In the selected scope’s Role assignments view, locate the principal and role, select the assignment, choose Remove or Delete, and confirm. If the entry is inherited, navigate to the parent scope where it was created.

Removing one assignment might not remove effective access because another direct, inherited, group-based, eligible, or time-bound assignment can still grant the operation. Recheck the principal’s effective access after cleanup. Token and cache propagation can also delay the observed result, so avoid treating an immediate portal refresh as the only validation.

radio_button_uncheckedshort_text17. Audit Azure RBAC changes with the Azure Activity Log

Changes to role assignments and custom role definitions in a subscription are management operations recorded in the Azure Activity Log. The log is useful for audits and troubleshooting because it shows the operation, caller, target scope, timestamp, status, and related details.

The Azure Activity Log retains subscription events for 90 days by default. For longer retention, centralized analysis, or correlation with other signals, export it through diagnostic settings to a Log Analytics workspace, Azure Storage, or Azure Event Hubs as appropriate.

radio_button_uncheckedshort_text18. Exercise: produce an Azure RBAC change report

1. In the portal, open Monitor or All services and select Activity log.
2. Choose the subscription and set Timespan to the required interval, such as Last month. A last-week report should use the corresponding seven-day interval.
3. Filter Event category to Administrative when needed, then add an Operation filter and search for role.
4. Select Create role assignment, Delete role assignment, Create or update custom role definition, and Delete custom role definition.
5. Open an event to inspect its summary and JSON details, including caller, action, scope, timestamp, and status.
6. Use Download as CSV for a simple point-in-time report. For durable reporting, send the log to Azure Monitor Logs and query the AzureActivity table.

AzureActivity
| where TimeGenerated > ago(30d)
| where Authorization has "Microsoft.Authorization/roleAssignments"
   or Authorization has "Microsoft.Authorization/roleDefinitions"
| project TimeGenerated, Caller, OperationNameValue, ActivityStatusValue, ResourceId
| order by TimeGenerated desc

radio_button_uncheckedshort_text19. Troubleshoot access methodically

radio_button_uncheckedshort_text20. Knowledge check: core Azure RBAC concepts

radio_button_uncheckedshort_text21. Exam decisions and common traps

• A role definition is the permission template; a role assignment binds that template to a principal at a scope.
• Contributor manages resources but cannot delegate Azure RBAC access.
• Reader at a child scope does not reduce Contributor inherited from a parent because grants are additive.
• NotActions subtracts from one role definition; it is not an explicit deny across all assignments.
• Azure roles manage Azure resources; Microsoft Entra roles manage directory resources.
• To investigate one person at one resource, begin with that resource’s Access control (IAM) > Check access.
• To list current assignments, use Role assignments; to report changes over time, use the Azure Activity Log.
• The narrowest sufficient role and scope is normally the least-privilege answer.

radio_button_uncheckedshort_text22. Summary, active recall, and official resources

Azure RBAC protects Azure resources by combining a principal, a role definition, and a scope in a role assignment. Effective access can include direct, inherited, group-based, conditional, and time-bound grants. Administrators verify access in Access control (IAM), grant and remove assignments deliberately, and use the Azure Activity Log to trace changes.

Active-recall checklist

• Can you explain authentication versus authorization without using the same definition twice?
• Can you identify the who, what, and where in an unfamiliar access request?
• Can you predict inherited access across all four scope levels?
• Can you distinguish Actions, NotActions, DataActions, and NotDataActions?
• Can you choose between Check access, Role assignments, Roles, and Activity log?
• Can you explain why removing one assignment might not remove effective access?

Official documentation

• What is Azure role-based access control (Azure RBAC)?
• Understand Azure role assignments
• Understand scope for Azure RBAC
• List Azure role definitions
• Check access for a user to an Azure resource
• Assign Azure roles using the portal
• View Azure RBAC changes in activity logs