Authorization
CoreAzure RBAC
Role-based authorization for Azure management and data-plane scopes.
Key points
- Azure RBAC evaluates role definitions and assignments at management or data-plane scopes.
- Inherited assignments, explicit denies, and DataActions can determine effective access beyond one visible role.
Best-known use cases
- Grant a group or workload only the operations it needs at the smallest durable scope.
What candidates often confuse it with
- Azure RBAC authorizes Azure resources; Entra directory roles and Conditional Access govern different identity responsibilities.
Key takeaway
Use Azure RBAC to express least-privilege Azure resource access at management-group, subscription, resource-group, resource, or supported data scopes.
Relevant exam tasks
- D1.2.S3 — Recommend a solution for authorizing access to Azure resources