Manage Azure identities and governance
Azure RBAC Roles, Scopes, and Access Evaluation
CoreChoose built-in roles, assign them at the correct scope, and explain effective inherited access.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Azure administration depends on granting the required resource actions at the narrowest practical scope and explaining why a principal’s effective access differs from one visible assignment.
Must Know
- An Azure role assignment combines a security principal, a role definition, and a scope.
- Assignments inherit downward from management group to subscription, resource group, and resource unless another control changes the result.
- Owner can manage resources and assign Azure roles; Contributor manages resources but cannot assign roles; User Access Administrator manages user access without general resource management.
- Effective access can come from direct assignments, group membership, inherited assignments, and deny assignments.
Compare and Distinguish
- Entra role vs Azure RBAC role: directory roles authorize tenant-directory tasks; Azure roles authorize management or data actions against Azure resources.
- Owner vs Contributor vs User Access Administrator: full resource plus access control vs resource management only vs access management only.
- Azure RBAC vs Azure Policy vs resource lock: who may perform an action vs whether resource state is compliant or allowed vs protection from control-plane modification or deletion.
Scenario examples
- Scenario: An operator can configure a storage account but cannot grant another user access. Think: Contributor lacks role-assignment permission, so add a suitable access-management role at the required scope.
- Scenario: A user has no role shown directly on a VM but can restart it. Think: Inspect group-based and inherited assignments from the resource group and subscription.
- Scenario: A team needs read access to one resource group only. Think: Assign Reader at that resource group instead of at the subscription.
Exam traps
- Contributor is not an access-administration role, despite its broad resource-management permissions.
- A role assigned at subscription scope cannot be narrowed by adding a smaller-scope assignment.
- An Entra directory role does not automatically authorize VM, storage, or network resource operations.
Key takeaways
- Solve Azure authorization as principal plus role plus scope, then account for inheritance and group membership.
- Choose the narrowest scope that covers the intended resources without creating repetitive assignments.
How it works
- Azure Resource Manager evaluates assignments that apply to the requested resource and action, including assignments inherited from parent scopes.
- Group assignments reduce administrative repetition because members receive the group’s applicable permissions.
Objects and administrative surfaces
- Management group, subscription, resource group, or resource — role assignments and inherited access in Access control (IAM).
- Tenant — principals and directory roles in Microsoft Entra ID; this is distinct from Azure resource scope.
- Resource data plane — some services use data-action roles in addition to management-plane roles.
When to use it
- Use built-in roles when one matches the required job function and assign them to groups for repeatable operations.
- Use resource-level scope for isolated exceptions and higher scopes for a genuinely shared responsibility boundary.
Security and governance implications
- Prefer least privilege and time-bound privileged access where the organization supports it.
- Regularly review broad Owner and User Access Administrator assignments because they can expand others’ access.
How to reason about this
- Start with the failed operation, identify whether it is management-plane or data-plane, then trace direct, group, and inherited assignments.
- Confirm the assignment scope covers the target and allow time for a recent access change to propagate before changing roles again.
More detail
- Built-in role definitions contain allowed management and data actions; role assignments bind those definitions to users, groups, service principals, or managed identities.
- Access control views can show assignments at the current scope and inherited scopes, while the check-access experience helps trace a principal’s effective permissions.
Ready for the quiz?
- Which three elements form an Azure role assignment?
- Why might a user have access when no direct resource assignment is visible?
- Which built-in role distinction matters when the task is assigning access rather than changing resources?
Related objectives
- D1.2.S1 — Manage built-in Azure roles
- D1.2.S2 — Assign roles at different scopes
- D1.2.S3 — Interpret access assignments