Identity and access
CoreAzure RBAC
Authorization model based on principal, role definition, scope, and assignment.
Key points
- Each assignment binds a principal, role definition, and scope.
- Assignments inherit from management groups through subscriptions and resource groups to resources.
- Effective access includes direct, group-based, inherited, and deny paths.
Best-known use cases
- Grant a team operational access to one resource group.
- Trace why a user can change a resource.
What candidates often confuse it with
- Azure RBAC vs Entra roles: Azure resource authorization vs directory administration.
- Azure RBAC vs Policy: permitted actor actions vs allowed or compliant resource state.
Key takeaway
Choose the least-privileged Azure role at the narrowest scope that covers the required resources.
Related services
- Azure built-in roles
Relevant exam tasks
- D1.2.S1 — Manage built-in Azure roles
- D1.2.S2 — Assign roles at different scopes
- D1.2.S3 — Interpret access assignments