Azure Role-Based Access Control Cheat Sheet

• A role-based access control service to manage user’s access to Azure resources including what they can do with those resources and what areas they can access.
• It is an authorization system based on Azure Resource Manager, which provides fine-grained access management of Azure resources.

Concepts

• A role assignment is composed of security principal, role definition, and scope.
  • Security Principal – an object representing a user, group, service principal, and managed identity that requests access to Azure resources.
  • Role Definition – a list of permissions that can be performed, such as read, write and delete.
  • Scope – set of resources to which access applies.
• Attaching a role definition to a user, group, service principal, and managed identity to grant access to a particular scope is called role assignment.

• You can attach multiple role assignments since RBAC is an additive model.
• Azure RBAC supports both allow and deny assignments.
  • Deny assignments explicitly block actions, even if a role assignment grants them. They are primarily created and managed by Azure services (like Blueprints) to protect critical resources; standard users cannot create them via the portal.
  • Custom Role Management has been enhanced. Custom roles can now be created with conditions, and their JSON definitions can be edited more easily in the Azure portal.

Roles

• Classic subscription administrator roles have full access to an Azure subscription (Legacy – Deprecated for resource management as of August 2024.).
  • Account Administrator
    • You can only have 1 Account Administrator per Azure account.
    • This role is the billing owner of the Azure subscription.
    • It can manage subscriptions and billings in the account.
    • Create and cancel subscriptions.
  • Service Administrator
    • For this role, you can only have 1 Service Administrator per Azure subscription.
    • For new subscriptions, the Account Administrator is also the Service Administrator. This role has full access to the Azure portal.
    • It can assign users with a Co-Administrator role.
  • Co-Administrator
    • You can only create 200 Co-Administrator per Azure subscription.
    • This role has the same privileges as the Service Administrator, but it can’t change the association of subscriptions to Azure directories.
    • A user with this role can only assign a Co-Administrator role to other users.

• Azure Roles – Azure RBAC has over 70 built-in roles. The following are the four fundamental Azure roles:
  • Owner 
    • Full access to all Azure resources.
    • Delegate access to other users.
  • Contributor
    • Create and manage all types of resources in Azure.
    • It cannot grant access to other users.
  • Reader
    • A user with this role can only view Azure resources.
  • User Access Administrator
    • It has permissions to manage user access to all types of resources.
    • Key Vault Contributor: Allows management of key vaults but does not grant access to keys, certificates, or secrets.
    • VM Contributor: Permits management of virtual machines but does not grant network or storage account access, adhering to the principle of least privilege.
    • DNS Zone Contributor: Manages DNS zones and record sets but not the virtual networks they are linked to.
    • The Contributor role has been refined. It no longer inherently grants the ability to assign roles in Azure RBAC; this is now the exclusive domain of the Owner and User Access Administrator roles.
• Microsoft Entra Roles – Provide access to manage Microsoft Entra resources in a directory such as create users, assign administrative roles to others, manage licenses, reset passwords, and manage domains.

  • The service Azure Active Directory (Azure AD) has been officially rebranded to Microsoft Entra ID. All role names and documentation now reflect this change (e.g., “Azure AD roles” are now “Microsoft Entra roles”). 

  • Global Administrator
    • This role can manage access to all the administrative features in Microsoft Entra ID.
    • It can assign administrator roles to the users in your organization.
    • Reset the password of users and administrators in the account.
  • User Administrator
    • Create and manage different types of users and groups in Azure.
    • Manage support tickets and monitor service health.
    • This role can only change the passwords of users and administrators.
  • Billing Administrator
    • Make purchases in Azure.
    • The role can also monitor service health.
    • Manage subscriptions and support tickets.

Best Practices

• Use Azure RBAC to segregate duties within your team and only grant the access your users need.
• Limit the number of subscription owners (max of 3) to reduce the potential for breach by a compromised owner.
• You can use Microsoft Entra PIM to protect privileged accounts from malicious cyber-attacks.
• Use Microsoft Entra Privileged Identity Management (PIM) for just-in-time (JIT) access to privileged roles instead of permanent assignment.
• Implement periodic access reviews for all role assignments, especially for privileged roles and guest users.

Validate Your Knowledge

Question 1

Question Type: Single choice

Your company has an Azure subscription named ManilaSubscription that contains multiple virtual machines.

The subscription has a user named ManilaUser01 which has the following roles:

• Backup Reader

• Storage Blob Data Contributor

• DevTest Labs User

You need to ensure that ManilaUser01 can assign a Reader role to all the users in the subscription.

What role should you assign?

1. Assign the User Access Administrator role.
2. Assign the Security Reader role.
3. Assign the Virtual Machine Contributor role.
4. Assign the Security Admin role.

Show me the answer!

Correct Answer: 1

Azure RBAC is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources. Access management for cloud resources is a critical function for any organization that is using the cloud. Azure role-based access control (Azure RBAC) helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to.

The four fundamental Azure roles are Owner, Contributor, Reader, and User Access Administrator. To assign a Reader role to all the users in the Azure subscription, you must grant the user a User Access Administrator role. This role allows you to manage user access to the Azure resources.

Hence, the correct answer is: Assign the User Access Administrator role.

The option that says: Assign the Security Reader role is incorrect because this role only allows the user to view permissions in the Security Center.

The option that says: Assign the Virtual Machine Contributor role is incorrect because this role just lets you manage virtual machines. Take note that this role doesn’t allow you to access virtual machines directly nor assign a Reader role to all the users in the subscription.

The option that says: Assign the Security Admin role is incorrect. This role has the same permissions as the Security Reader role. The only difference is that it can update the security policy and dismiss alerts and recommendations.

 

References:

https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

Check out this Azure RBAC Cheat Sheet:
https://tutorialsdojo.com/azure-role-based-access-control-rbac/

Microsoft Entra ID vs Role-Based Access Control (RBAC):
https://tutorialsdojo.com/microsoft-entra-id-vs-role-based-access-control-rbac/

 

Note: This question was extracted from our AZ-104 Microsoft Azure Administrator Practice Exams.

For more Azure practice exam questions with detailed explanations, check out the Tutorials Dojo Portal:

Azure RBAC Reference:

https://docs.microsoft.com/en-us/azure/role-based-access-control/overview