Azure RBAC roles, scopes and custom roles
Almost every AZ-104 identity question comes down to one thing: who gets which role at which scope. Azure role-based access control (Azure RBAC) controls access to Azure resources, and it is separate from Microsoft Entra roles.
The three parts of an assignment
A role assignment combines a security principal (user, group, service principal or managed identity), a role definition (a set of allowed actions) and a scope. You create it in Access control (IAM) on the scope.
Scope and inheritance
Scopes form a hierarchy: management group, subscription, resource group, resource. An assignment at a higher scope is inherited by everything below it. To follow least privilege, assign at the lowest scope that works. To avoid repeating work across many subscriptions, assign at a management group.
Roles to know
| Role | What it does |
|---|---|
| Owner | Full access, including assigning roles |
| Contributor | Create and manage resources, cannot assign roles |
| Reader | View only |
| User Access Administrator | Manage role assignments only |
| Virtual Machine Contributor | Manage VMs, not the network or storage they connect to |
| Network Contributor | Manage networks |
| Storage Blob Data Contributor | Read, write, delete blob data |
Management actions and data actions are different. Contributor on a storage account lets you manage the account, but reading blobs through Entra ID needs a data role such as Storage Blob Data Reader.
Custom roles
Create a custom role when no built-in role fits. A definition has Actions, NotActions, DataActions, NotDataActions and AssignableScopes. Assignable scopes can be management groups, subscriptions or resource groups. To reuse a role in more subscriptions, edit it and add them; do not create copies.
Managed identities
A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource that several resources can share. In both cases you still assign Azure roles to the identity.
Exam traps
- Permissions are additive. Several roles on a user add up; the only subtractions are deny assignments and NotActions within one role.
- Owner and User Access Administrator are the only common roles that can assign roles. Contributor cannot.
- Azure roles manage Azure resources. Entra roles such as User Administrator manage the directory. Do not mix them.
- Assigning a role to a group is easier than to many users, and the exam usually favours it for minimal administrative effort.
- Removing a lower role does not help if the user inherits the same permission from a higher scope.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A user must be able to grant the Reader role on one virtual network to other users, and nothing else. Which role should you assign at the virtual network scope?
Show answer
Answer: C.Only User Access Administrator (or Owner) can create role assignments. Contributor and Network Contributor manage resources but cannot assign roles.
2. You assign a user the Contributor role on a management group. At which scopes does the user have Contributor rights?
Show answer
Answer: C.Role assignments are inherited downward from management group to subscription, resource group and resource.
3. A custom role must be usable in resource groups in Sub1 and Sub2 with the least effort. What do you do?
Show answer
Answer: B.A custom role can list several assignable scopes, so one definition can be assigned in both subscriptions.
4. A service on a VM must manage resources in RG1 using the VM's own identity. What do you configure first?
Show answer
Answer: B.Enable a system-assigned managed identity on the VM, then grant it a role in Access control (IAM) of RG1.